For most vendors, "your data is encrypted" means encrypted with the vendor's key. That answer stalls enterprise security reviews. With bring your own key, you register an encryption key from your own Google Cloud KMS and keep ownership of the key lifecycle: rotation, revocation, and policy all stay in your hands.

Scalekit never stores your key material. Every encrypt and decrypt operation is a call to the KMS API against the key you control, so revoking access in your KMS revokes Scalekit's ability to decrypt, immediately and provably.

How it works

• Grant Scalekit two IAM roles at the key level: cloudkms.cryptoKeyEncrypterDecrypter and cloudkms.viewer. Nothing broader is required.
• A registered key starts in a staged state and becomes primary on activation; exactly one primary key exists at a time.
• After activating a new key, trigger re-encryption from the dashboard to migrate existing records on your schedule.
• Rotation and revocation happen in your KMS, where your security team already manages every other key.

Read the encryption keys docs to register your key.