Documentation / Platform glossary / Data Encryption Key
A data encryption key is the key that encrypts actual content — a document, a record, a file. It is the only key in an envelope hierarchy that touches payload bytes, and its scope determines how much data a single compromised key would expose.
DEKs are symmetric, because symmetric algorithms are fast enough for bulk content where asymmetric ones are not. The same key encrypts and decrypts, so protecting the key is the whole of protecting the data.
Scope is the design decision that matters most. A DEK per object means compromise exposes one object. A DEK per tenant means compromise exposes one customer. A single DEK for all content means compromise exposes everything. Narrower scope is strictly safer and costs more keys to manage — which is what the wrapping layer above exists to absorb.
A DEK is almost never stored in plaintext. It is wrapped by a key encryption key and stored alongside the ciphertext, so reading an object means retrieving the ciphertext, unwrapping the key, and decrypting. Someone with storage access but no unwrap authority holds two things they cannot use.
Lifetime follows from scope. Per-object keys are effectively immutable, since the object is written once with its key; the key is retired when the object is deleted. Longer-lived keys covering many objects need explicit rotation, which means re-encrypting the data they cover.
This is why deletion and encryption interact. Destroying a key that protects only one tenant's content renders that content unreadable regardless of whether every copy has been located — sometimes called crypto-shredding.
When someone asks how customer documents are protected at rest, the DEK is the layer that actually does it. Everything above exists to protect and manage it.
The revealing question is not whether data keys are used but how narrowly they are scoped, because that single answer determines the exposure of any individual key compromise.
QueryTek encrypts stored tenant documents with data keys that are wrapped rather than stored in the clear, and scopes keys so that no single data key spans the whole corpus. Key scoping specifics and storage wiring are not published.
