Encryption is the easy part. Everything that happens to the key afterwards is the discipline.
Encrypting data is a solved problem — the algorithms are standard and nobody sensible writes their own. What remains is the key: where it was generated, who can use it, how it is rotated, what happens when someone leaves, and how you prove any of that to an auditor a year later. That is key management, and it is where real systems fail.
A key has a lifecycle: generated, in use, rotated, retired, eventually destroyed. Data encrypted under an old version must still be readable, so retirement is not deletion. Envelope encryption keeps this practical at scale — a data key protects the data, a managed key protects the data key — so rotating the managed key does not mean re-encrypting terabytes.
To understand the mechanics from the inside, without a licence question attached.
Where hardware key custody and compliance evidence become the actual product.
One sentence worth keeping: the strength of your encryption is the strength of your key custody. An AES-256 key in a repository is not encryption, it is filing.
Tell us which clouds you run in, whether the requirement is keys or secrets or both, and whether a regulator is involved. You get a shortlist and the reasoning behind it. Your details are not passed to vendors.