In My Own Vault, Locked With My Own Key
"Your data never crosses a border" is not a story about patriotism. It is a question of whose storage the assessment results sit in and who holds the key. We unpack BYOK and adequacy decisions through the analogy of a bank safe deposit box.
Say you are storing valuables at a bank. There are two ways to do it.
One is to hand the items over at the counter. The bank stores them somewhere on its own terms and brings them out when you need them. It is convenient. But I have no idea which branch, which room, my items are sitting in right now.
The other is a safe deposit box. The box sits inside the bank’s building, but I hold the key. Not even a bank employee can open that box without my key.
Both approaches use the bank in exactly the same way. What differs is who holds the key. This installment is about that difference.
Assessment results end up somewhere too
In the fourth installment, we covered how to assess a cloud environment without installing anything. But once you run an assessment, an artifact comes out of it. It is a document listing which server has which hole, and which account has excessive permissions attached to it.
That document is a map of the company’s weak points. Which is why EU customers, especially in finance or the public sector, always ask about it before signing: “Where is that map stored?”
Handing it over at the counter versus renting a box
INFERRED It is a common structure for an assessment service to collect results on its own servers. That does not mean it is the wrong approach. It just means one more question gets attached at that moment. Which country is that server in, and can that company’s employees see my map?
FACT SecurityHero RMF chose the safe deposit box side. Scan results and reports are stored in an S3 bucket the customer designates. S3 is AWS’s file storage. And those files are encrypted with a KMS key the customer owns. KMS is AWS’s key storage service, and this approach — where the customer uses their own key — is called BYOK (Bring Your Own Key).
To summarize, here is how it splits. You only need to look at the “key owner” row on the right.
| Handing it over at the counter | Safe deposit box (the RMF approach) | |
|---|---|---|
| Where the items sit | The service company’s storage | S3 inside the customer’s own AWS account |
| Key owner | The service company | The customer (customer-owned KMS key) |
| If the contract ends | You have to ask about the retrieval process | Exactly where it always was — in my account |
FACT Because the data never leaves the boundary of the customer’s storage, this structure serves as a basis for addressing the data control requirements that DORA and NIS2 impose.
What “it never crosses a border” actually means
FACT The EU has a mechanism called an adequacy decision. It is a decision in which the EU recognizes that “that country protects personal data as well as we do.” Sending data to a recognized country becomes considerably easier. South Korea and Japan are among the countries that have received this decision. That makes conditions for entering the EU market that much more favorable.
INFERRED But there is a simpler answer available. Don’t send it out in the first place. Explaining things on the basis of an adequacy decision means persuading the other company’s legal team. Whereas “your data never leaves your account” has nothing to persuade anyone of. Nothing went out, so there is no border-crossing to argue about.
Sorting out the confusing terms
| Term | In plain words |
|---|---|
| Data sovereignty | I decide where my data sits and who opens it |
| BYOK | You may rent the lock, but you use your own key |
| KMS | The key storage box AWS provides |
| Adequacy decision | The EU’s recognition that “you may send data to that country” |
| Agentless | An assessment that installs no program on the customer’s servers |
Things to Note
- This post is not legal advice. Whether NIS2 and other regulations apply, and how they are interpreted, differs by country, by industry, and by company size. Actual judgments should be made with a qualified legal professional.
- An RMF report is not a certificate. It is technical supporting evidence used for regulatory response. Issuing certifications, incident notification (NIS2 Article 23 and the like), and legal representation are not included here.
- BYOK does not settle every regulatory question either. Storage location and key ownership are only one axis of data control. How to record access logs and how long to set retention periods are matters each company has to decide as policy.
- The product-related descriptions in this post were written strictly within the scope of published product specifications. Actual configurations may differ depending on the customer environment.
Series contents
- Why you have to submit security paperwork to sell into the EU
- Why the phrase “risk assessment” sounds so difficult
- There are 3,000 things to fix — where do I start?
- How do you assess anything without installing anything?
- What “your data never crosses a border” means ← this post
- Facing multiple countries with a single document