AdminEncryption keys (CMEK)

Customer-managed encryption keys

Copy page



Use a key you hold in your own cloud to encrypt data that Claude stores.

With customer-managed encryption keys (CMEK), you create a key in your own AWS KMS, Google Cloud KMS, or Azure Key Vault. Anthropic uses it to encrypt certain data at rest. The key stays under your control, so you can rotate it, audit its use, and remove Anthropic's access.

Choose your setup page

Choose the service that holds your key. Claude Platform on AWS, which also uses AWS KMS, has its own page.

On Claude Platform, you can also add and attach your key with the Admin API.

Understand CMEK before you set it up

Which product you use decides what your key encrypts, what stays under Anthropic's key, and which features turn off or change.

What you commit to

• Once you attach a key, you can't remove or replace it.
• Your key protects only data written after it takes effect.
• If your key is deleted, Anthropic can't recover the data it protects. While the key is disabled, Claude can't read that data.
• On Claude Platform, a workspace with a key must retain data.

Who can use CMEK

CMEK is optional. To turn it on for an eligible organization, contact your Anthropic account team. You need one of these roles to set it up:

• Claude Platform: Organization Admin
• Claude Platform on AWS: Admin
• Claude Enterprise: Owner or Primary Owner

After setup

• What happens when you rotate, disable, or delete your encryption key
• Troubleshoot CMEK