DEK

A DEK (Data Encryption Key) is the key that encrypts a specific message or file under BYOK. How it works:

• A random key is generated for each message
• It's used once and immediately wiped from memory
• The DEK itself is encrypted with a KEK
• It's stored alongside the encrypted data

This approach is called envelope encryption, and it delivers maximum security: even if one key is compromised, the rest of your data stays protected.