The cryptographic keys are managed exclusively in AWS KMS and are physically and logically separated from the protected data. AWS KMS is based on a hardened HSM backend with FIPS 140-2 Level 3 certification.

No employee has direct access to the keys — only authorized AWS service components can use them. In justified exceptional cases, access can be requested with explicit approval from the technical management.

All key usage is logged via CloudTrail. Annual automatic rotation is enabled for all KMS keys. AWS credentials are rotated every 90 days, and IAM database tokens expire after 15 minutes.