# KEK

> Key Encryption Key: a key that encrypts other keys in Pachca's BYOK setup. It's derived from the master key stored in your KMS, fully under your company's control

Источник: https://pachca.com/en/glossary/kek

A KEK (Key Encryption Key) is the intermediate key in the BYOK setup. Its role:

- It's derived from the master key, taking context into account
- It's used to encrypt DEKs
- Each data type gets its own KEK
- It's never stored: it's generated on demand

The chain looks like this: master key (in your KMS) → KEK (derived) → DEK (for data). Compromising one KEK doesn't give access to any other data.

Learn more in the Help Center

[Read the article →](https://pachca.com/en/help-center/administration/byok)