Each tenant has a unique Data Encryption Key (DEK) for PHI columns. DEKs are wrapped by a Key Encryption Key (KEK) stored in AWS KMS (or customer-managed CloudHSM).Documentation Index
Fetch the complete documentation index at: https://docs.medera.info/llms.txt
Use this file to discover all available pages before exploring further.
Rotation
- DEK rotation: quarterly, transparent re-encryption
- KEK rotation: annual