> ## Documentation Index > Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt > Use this file to discover all available pages before exploring further. # Corsa-managed keys: field-level encryption with no setup > Encrypt sensitive client fields with a KMS key that Corsa operates. Every feature keeps working, and there's nothing to deploy in your cloud. Every Corsa workspace is encrypted at rest (AES-256) and in transit (TLS 1.2+). With Corsa-managed keys, you can also encrypt individual sensitive client fields, such as names, contact details and government ID numbers, with a dedicated key that Corsa operates in AWS KMS. You don't run anything in your own cloud. Every product feature keeps working on the protected fields, including rules, fuzzy sanctions and PEP screening, search, KYC integrations, AI features and exports. > [!NOTE] > > Corsa-managed keys protect sensitive fields from anyone who can read Corsa's storage, backups or logs. They don't hide plaintext from Corsa: Corsa operates the key and decrypts on its servers. If you need to own the key and revoke Corsa's access, see [BYOK](https://docs.corsa.finance/encryption/byok.md). If stored sensitive fields must stay unreadable to Corsa, see [HYOK](https://docs.corsa.finance/hyok/index.md). *** ## How it works 1. When a protected field is written through any path (API, SDK, KYC integration or the app), Corsa's isolated encryption service asks the Corsa-managed KMS key for a data key. It encrypts the field with AES-256-GCM. 2. Every KMS call carries the encryption context `platformId = `, so a data key created for your workspace can't be used for another workspace. 3. Each encrypted value is bound to its workspace, entity type and field. Corsa rejects a value that was copied to a different field or workspace. 4. Corsa stores the encrypted value and a keyed search index, computed with a secret that's unique to your workspace. It never stores the plaintext of protected fields. 5. When a signed-in user or an API caller with access reads the field, the encryption service decrypts it and returns the plaintext. Corsa caches decrypted data keys in memory for a few minutes and reuses one data key for a short window of new writes. This keeps encryption fast on high-volume ingestion. *** ## Corsa-managed keys compared with BYOK and HYOK | | Corsa-managed keys | BYOK | HYOK | | - | - | - | - | | **Who holds the key** | Corsa, in AWS KMS | You, in your AWS KMS | You, in your AWS KMS | | **Setup in your cloud** | None | One KMS key | A CloudFormation stack | | **Key rotation** | Automatic, by Corsa | You control it | You control it | | **Revoke Corsa's access** | No | Yes, disable the key | Corsa can't decrypt stored values | | **Audit of key use** | Corsa's audit log | Your CloudTrail and Corsa's audit log | Your own audit logs | | **Product features on protected fields** | All | All | [Reduced](https://docs.corsa.finance/hyok/limitations.md) | See [encryption tiers](https://docs.corsa.finance/encryption/index.md#encryption-tiers) for the full comparison. *** ## Turn on Corsa-managed keys **1. Open the encryption settings** A workspace **Owner** opens **Settings** → **Developers** → **Encryption**. **2. Choose the tier** Under **Encryption tier**, select **Corsa-managed key**. No key, stack or verification step is needed. **3. Choose the fields to protect** Select the sensitive fields to encrypt, such as names, government ID numbers and contact details, and save. See [fields you can encrypt](https://docs.corsa.finance/encryption/index.md#fields-you-can-encrypt). From then on, Corsa encrypts the selected fields on every write. You don't need to change your API calls, SDK code or KYC integrations: send plaintext as before, and Corsa encrypts it on the server. > [!NOTE] > > You choose **one tier per workspace**. Once Corsa-managed keys are active, you can't switch to BYOK or HYOK, or remove encrypted fields, yourself. Contact your Corsa representative to plan a change. If you don't see the **Encryption** page, ask your Corsa representative to enable it for your workspace. Only workspace **Owners** can change the encryption configuration. Members with the **Support** role can view it. *** ## Search and screening on protected fields * **Search.** Exact-match search, such as finding a client by email address or ID number, uses the keyed search index. It works without decrypting stored values. * **Screening and rules.** Sanctions and PEP screening, rules and workflows read the decrypted values on Corsa's servers. Fuzzy name matching keeps working. * **AI features and exports.** These read decrypted values, like any other Corsa feature. *** ## Check your configuration Use [`GET /v1/platforms/encryption-config`](https://docs.corsa.finance/encryption/index#check-your-encryption-configuration) to read your workspace's encryption configuration. With Corsa-managed keys, `deploymentModel` is `saas` and `encryptionFieldsList` lists the protected fields. A `204 No Content` response means you haven't set up field-level encryption. Your data is still encrypted at rest and in transit. *** ## If decryption is unavailable If the encryption service can't decrypt a value, for example during a KMS outage, Corsa fails closed. It never returns ciphertext as if it were plaintext: * **Reads** return the field as `[encrypted:DECRYPT_UNAVAILABLE]` instead of the value. Other fields in the response are unaffected. * **Writes** of protected fields fail with a retryable error, so no plaintext is stored by mistake. Retry the request. Contact Corsa support if masked values persist. *** Learn more about Corsa's [security approach](https://docs.corsa.finance/security/index.md), or [schedule a demo](https://calendly.com/michellelatzer/welcome-to-corsa) to discuss your encryption requirements. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.