# DEK

> Data Encryption Key: a unique key that encrypts each message in Pachca. Part of the BYOK setup for maximum data protection

Источник: https://pachca.com/en/glossary/dek

A DEK (Data Encryption Key) is the key that encrypts a specific message or file under BYOK. How it works:

- A random key is generated for each message
- It's used once and immediately wiped from memory
- The DEK itself is encrypted with a KEK
- It's stored alongside the encrypted data

This approach is called envelope encryption, and it delivers maximum security: even if one key is compromised, the rest of your data stays protected.

Learn more in the Help Center

[Read the article →](https://pachca.com/en/help-center/administration/byok)