Customer-Managed Encryption Keys

Customer-Managed Encryption Keys means the keys that unlock data stored in the cloud are held and managed by the customer who owns the data, not the company running the service.

Think of it like renting a bank vault where you, the customer, keep the key instead of the bank. The bank provides the vault space and the management system, but only you can open it. That means you can revoke the bank's access at any time by taking back the key, and if needed, you can destroy the key to make the vault's contents essentially unreadable forever.

This matters especially in industries with strict data-handling rules, like finance or healthcare. Even though the data itself has to be stored somewhere, keeping final control over who can unlock it in the customer's hands is often the key to meeting regulatory requirements.

In the article, Customer-Managed Encryption Keys appear as one of three opt-in components of Anthropic's Enterprise Frontier Safeguards. Customer-owned storage, customer-managed encryption keys, and fully automated review can each be turned on or off independently, because where data is stored and who holds the key to unlock it are separate issues. Simply moving storage to the customer's own cloud doesn't amount to full control if the service provider still holds the encryption key, which is why the two are kept separate and selectable on their own.