Compare key management and secrets platforms

A key management service creates, stores and uses cryptographic keys on your behalf. The defining property is that key material does not leave it: you send data to be encrypted or decrypted rather than fetching the key. That boundary is the whole point — a key that never leaves cannot be copied off a compromised server.

A KMS handles cryptographic keys and performs operations with them. A secrets manager stores arbitrary strings — database passwords, API tokens — and hands them to applications that need them. Most organisations need both, and most confusion in this category comes from tools that do some of each without saying which they are.

Encrypt your data with a locally generated data key, then encrypt that data key with a key held in the KMS and store the result alongside the data. You get one small KMS call rather than sending gigabytes through the service, and revoking the KMS key makes every data key it wrapped useless at once.

Bring your own key: you generate key material and import it into the provider, which then holds it. Hold your own key: the key never enters the provider at all — it stays in your system and the provider calls out to you for every operation. BYOK is about provenance, HYOK is about control, and only HYOK lets you technically deny the cloud access. Google’s External Key Manager and Fortanix are the practical routes to it.