Data Protection, Encryption, and Key Management
Envelope encryption on IBM Cloud
Data is encrypted with data encryption keys; data encryption keys are wrapped by a root key held in Key Protect or Hyper Protect Crypto Services (HPCS). Key Protect is FIPS 140-2 Level 3 and multi-tenant. HPCS is FIPS 140-2 Level 4, supports keep-your-own-key where you initialize crypto units with smart cards, and can serve as root of trust for Key Protect.
Key lifecycle
Root keys are regional and cannot be exported. Lifecycle actions are create, rotate, disable (reversible), and delete (destroys the ability to unwrap dependent data). Rotation re-wraps keys without re-encrypting bulk data. Services such as Cloud Object Storage, VPC block volumes, File Storage, and managed databases integrate for bring-your-own-key.
Data-level controls
Object Storage offers provider-managed encryption, key-protect-backed encryption, and customer-supplied keys, plus immutable retention policies and bucket policies. Secrets Manager holds application secrets separately from encryption keys. Data residency depends on the region you choose at provisioning, not on the account.
Worked example
A regulated workload needs customer-controlled keys. Provision HPCS in the target region, initialize crypto units with the smart-card quorum, create a root key, authorize the Object Storage instance to HPCS, then create the bucket referencing that root key. Verify the integration before loading data, because a later delete of the root key is unrecoverable.
Traps that cost marks
Disabling a root key breaks decryption just as thoroughly as deleting it, but only disable is reversible. Encryption at rest does not stop exposure from a public bucket or an over-broad IAM policy. Cross-region key use is not automatic; root keys are regional.