Use your own encryption key (AWS KMS)

Protect this workspace's files, call recordings and stored secrets with a key in your own AWS account, and lock them by revoking it.

For: Workspace admins (Enterprise add-on; coming soon)

Steps

Open Settings → Security centre and select Manage on Encryption keys.
In your AWS account, create a symmetric KMS key (Encrypt and decrypt) in the region shown: ap-southeast-1 for Singapore storage, ap-southeast-5 for Malaysia storage.
Create an IAM role with a custom trust policy. Copy the trust policy from the page — it names MetriCRM and this workspace's external ID — then add the permissions policy shown to the role.
Add the key policy statement shown to your key's key policy, so the role may use the key.
Back in MetriCRM, enter the key ARN and the role ARN, select Save, then Test key. Every step should show OK.
Select Turn on customer-managed key. Existing files, recordings and secrets are re-wrapped in the background; the progress bar shows how far it is.

Your key never leaves AWS. MetriCRM asks it for a workspace key, keeps that key unlocked in memory for at most a few minutes, and wraps every file's and secret's own key with it.
Revoking the key — disabling it, removing MetriCRM from its policy or deleting the role — locks files, recordings and stored secrets within minutes. Everyone sees an "Encryption key unavailable" banner; admins and MetriCRM support are alerted and the audit log records it. Records such as accounts, cases and messages keep working.
Database records are encrypted at rest by our database provider with keys it manages; your key doesn't control them. Sign-in and single sign-on settings, audit log streaming credentials, your logo and IVR prompts also stay on platform keys.
Rotate key creates a new workspace key (from the same or a newly tested KMS key) and moves every item to it. Turn off moves everything back to platform keys — keep your KMS key working until it finishes.

Still need help? Contact support

Protect this workspace's files, call recordings and stored secrets with a key in your own AWS account, and lock them by revoking it.

For: Workspace admins (Enterprise add-on; coming soon)

Open Settings → Security centre and select Manage on Encryption keys.
In your AWS account, create a symmetric KMS key (Encrypt and decrypt) in the region shown: ap-southeast-1 for Singapore storage, ap-southeast-5 for Malaysia storage.
Create an IAM role with a custom trust policy. Copy the trust policy from the page — it names MetriCRM and this workspace's external ID — then add the permissions policy shown to the role.
Add the key policy statement shown to your key's key policy, so the role may use the key.
Back in MetriCRM, enter the key ARN and the role ARN, select Save, then Test key. Every step should show OK.
Select Turn on customer-managed key. Existing files, recordings and secrets are re-wrapped in the background; the progress bar shows how far it is.

Your key never leaves AWS. MetriCRM asks it for a workspace key, keeps that key unlocked in memory for at most a few minutes, and wraps every file's and secret's own key with it.
Revoking the key — disabling it, removing MetriCRM from its policy or deleting the role — locks files, recordings and stored secrets within minutes. Everyone sees an "Encryption key unavailable" banner; admins and MetriCRM support are alerted and the audit log records it. Records such as accounts, cases and messages keep working.
Database records are encrypted at rest by our database provider with keys it manages; your key doesn't control them. Sign-in and single sign-on settings, audit log streaming credentials, your logo and IVR prompts also stay on platform keys.
Rotate key creates a new workspace key (from the same or a newly tested KMS key) and moves every item to it. Turn off moves everything back to platform keys — keep your KMS key working until it finishes.

Still need help? Contact support