Documentation / Platform glossary / Envelope Encryption
Envelope encryption encrypts data with one key and then encrypts that key with another. The result is a chain of keys rather than a single secret, which is what makes rotation practical: changing a wrapping key re-encrypts only keys, not the terabytes of data underneath them.
A data encryption key encrypts the payload itself. That key is then wrapped by a key encryption key, and the wrapped result is stored alongside the ciphertext. A master encryption key may protect the wrapping layer, and a root of trust anchors the top of the chain.
The reason for the indirection becomes obvious when you consider rotation without it. Encrypting everything under one long-lived key means rotating that key requires decrypting and re-encrypting every object — an operation whose cost scales with total data volume and which is therefore deferred indefinitely. With an envelope, rotating a wrapping key means unwrapping and re-wrapping small key blobs. The cost scales with the number of keys, so rotation becomes routine rather than a project.
The second benefit is compartmentalization. Issuing a distinct data key per object or per tenant means a single compromised key exposes only what it encrypted. A shared key makes every object as exposed as the weakest access path to that key.
The third is separation of duties. The system that stores ciphertext need not be able to decrypt it, since the unwrapping authority lives elsewhere. Storage access alone yields nothing readable.
Envelope encryption is consequently the default for cloud key management services and for any platform storing regulated data at rest.
"Encrypted at rest" is a weak claim on its own; the substantive questions are how many key tiers exist, what scope each key covers, and whether rotation is operationally feasible. Envelope encryption is what makes the answers to those questions defensible.
It also bounds the consequence of a key compromise, which is the difference between a contained incident and a total one.
QueryTek encrypts stored tenant documents under an envelope model with separable key tiers, so key rotation does not require re-reading customer content and a single key does not span the whole corpus. Key identifiers, rotation procedures, and storage wiring are not published.
