How WorkOS Vault's local encryption works

WorkOS Vault provides local encryption that lets teams retain sensitive data within their own systems while outsourcing key management, tenant isolation, and key rotation infrastructure. It uses envelope encryption, generating a single-use data encryption key for each operation and protecting it with a longer-lived key encryption key stored in a non-exportable hardware security module. Applications use key contexts, such as organization identifiers, to automatically select or create isolated keys, with durable tenant-level contexts recommended to avoid key limits. In the underlying flow, Vault supplies a plaintext data key and its wrapped version, the application encrypts or decrypts data locally, and only wrapped key material is exchanged with WorkOS; SDK helpers simplify this process through high-level encrypt and decrypt methods. Vault also offers a separate storage API for customers who want WorkOS to persist encrypted objects, whereas local encryption is intended for organizations that control their own ciphertext storage. Its rekeying capability can move wrapped keys to a new context without decrypting or modifying the underlying data, supporting changes such as stronger tenant-specific isolation.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.