> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# HYOK Encryption for Compliance Data (Hold Your Own Key)

> Encrypt sensitive compliance data with your own keys. Full customer-side control over PII encryption using your KMS.

## About

Enterprise customers that wish to store highly sensitive information in Corsa are offered the **Sensitive Data Management** feature:

* Customers install the Corsa encryption service in their environment.
* Sensitive data is encrypted and decrypted using the customer's key.
* Encryption occurs on the customer's side, ensuring full control and compliance.
* The service connects securely to the customer's AWS KMS.
* End-to-end encryption control.

## System Requirements

* A modern Debian distribution (e.g. Ubuntu 24.04)
* Node.js 22.x
* 1 gigabyte of memory
* 1 gigabyte of storage

## Networking

* Inbound TLS (typically port 443)
* Outbound traffic can be restricted to TCP port 443 (needed for JWT verification from Auth0 and Corsa)

## Keys

There are 4 keys used to encrypt data and handle 2FA:

| Name                     | Type             | Description               |
| ------------------------ | ---------------- | ------------------------- |
| JWT\_SIGNING             | SIGN\_VERIFY     | JWT signing key           |
| INVITE\_CHALLENGE        | SIGN\_VERIFY     | Invitation challenge key  |
| TOTP\_SECRET\_ENCRYPTION | ENCRYPT\_DECRYPT | Two-factor authentication |
| ENCRYPTION               | ENCRYPT\_DECRYPT | PII encrypt / decrypt     |

Corsa currently supports **AWS KMS**.

### Setup

It is recommended to create the keys before launching an instance. See our [Terraform](/hyok/terraform) guide for an example.

***

## Verify Encryption Configuration

**Endpoint:** `GET /v1/platform/encryption-config`

Use this endpoint to retrieve the encryption configuration registered for your platform.

```json REST API theme={null}
GET /v1/platform/encryption-config
Authorization: Bearer <API_TOKEN>:<API_SECRET>
```

A `200` response returns the registered configuration. A `204 No Content` response means no configuration is registered. This endpoint reports configuration state; it does not test whether your HYOK service is currently reachable.

***

HYOK is available for enterprise customers. Learn more about Corsa's [security approach](/security/index) or [schedule a demo](https://calendly.com/michellelatzer/welcome-to-corsa) to discuss your encryption requirements.