Skip to main content
All glossary terms

Credentials & security

Envelope encryption

Envelope encryption protects data with a data-encryption key and then protects that key with another key, often managed by a key-management system. The encrypted data and wrapped key can be stored together, while the higher-level key controls access to decryption.

Also known as key-wrapping encryption.

Why it matters in practice

Separating data encryption from key-encryption operations can support centralized access control and key lifecycle management. The arrangement still depends on secure key policies, correct wrapping, and application authorization. It does not mean every request is encrypted end to end or that a compromised authorized process cannot read plaintext.

Example

A service encrypts a stored credential with a generated data key, then asks its KMS to wrap that key before storage.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.