The cryptographic keys are managed exclusively in AWS KMS and are physically and logically separated from the protected data. AWS KMS is based on a hardened HSM backend with FIPS 140-3 Level 3 certification.

Day-to-day key use is confined to authorized AWS service components. A small number of named break-glass and data-analysis roles additionally hold decrypt permission, restricted to a limited group of engineers; every such use is logged and alarmed. Placing that access behind explicit per-request approval from the technical management is in progress.

Every use of a document key is logged via CloudTrail with the calling principal, action, and timestamp — multi-region, integrity-validated, KMS-encrypted, and tamper-protected — so each key operation is auditable end to end. Key-policy and alias changes, denied access attempts, and any use of a document key by a principal outside amaise's own systems raise an immediate alarm to our security team. Annual automatic rotation is enabled for all KMS keys. AWS credentials are rotated regularly per security policy, and IAM database tokens expire after 15 minutes.