Unit 8: Key management: where keys live · Lesson 4 of 5 · 20 min Pro

Envelope encryption

Decrypt a customer export the way cloud services do: unwrap its data key with the KMS, decrypt locally, then forget the key.