---
title: "Encryption and keys"
url: https://developers.dagio.ai/encryption/
---

# Encryption and keys

   
                            
                                                                   
                  
                
          
   

## Choose an appropriate policy

Data protection distinguishes transport, storage and key control. Models can declare requirements; enforcement depends on effective capabilities and authorized configuration. A lock icon does not replace those checks.

| Concept | Expected value | Meaning |
| --- | --- | --- |
| Transport | Protected channel | Protection during exchange |
| Storage | Encryption of relevant resources | Protection of retained data |
| CMK / BYOK | Authorized key and integration | Service-specific key control |
| Rotation | Explicit policy | Key and access evolution |
| Revocation | Operation with documented effects | Withdrawal of cryptographic access |

## Understand AI processing

Encryption at rest and control of a key do not mean an AI provider never processes plaintext content. Operations needing content must be reviewed with their profile, provider and permissions. Do not confuse CMK or BYOK with a general promise of end-to-end encryption.

## Example

An organization protects Clients data with its key policy and restricts AI profiles allowed for quotes. Revoked or unavailable keys require an explanatory diagnostic; the system does not bypass policy through unprotected storage.

See [permissions](https://developers.dagio.ai/permissions/), [residency](https://developers.dagio.ai/residency/) and protection contracts in the [Model reference](https://developers.dagio.ai/reference/).

<!-- surface-examples:start -->

## Applied examples : Protect data while retaining useful context

Permissions control the operation and the policy bounds disclosed sources. Manage keys in Surface security settings.

### Configuration

Fragment placed in `contentActions[]`. [Properties and accepted values](https://developers.dagio.ai/reference/content-space-action-policy/).

```json
{
  "contract": "ContentSpaceActionPolicy@1",
  "spaceKey": "clients",
  "actionKey": "archive-client",
  "minimumRole": "owner"
}
```

### Variation and connection

Fragment placed in `contextPolicies[]`. [Properties and accepted values](https://developers.dagio.ai/reference/workspace-model-foundation/).

```json
{
  "key": "quote-knowledge",
  "targetDefinitionPaths": [
    "workspace/quotes/surface/quote"
  ],
  "sources": [
    {
      "key": "pricing",
      "kind": "knowledge",
      "definitionPaths": [
        "workspace/knowledge/surface/pricing"
      ],
      "linkTypePaths": [],
      "queryKey": null,
      "required": true,
      "revision": "current",
      "priority": 1,
      "maximumItems": 3,
      "maximumCharacters": 12000
    }
  ],
  "maximumCharacters": 16000
}
```

### UI layout example

The illustrative layout below places this configuration in the Clients/Quotes app. Insert each fragment at the stated location, with Field, Query and Action references matching the Model declarations.

1. Action
2. Minimum role
3. Authorized sources
4. Decision

<!-- surface-examples:end -->