> ## Documentation Index
> Fetch the complete documentation index at: https://docs.medera.info/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Management

> Per-tenant data encryption keys and KEK rotation

Each tenant has a unique **Data Encryption Key (DEK)** for PHI columns. DEKs are wrapped by a **Key Encryption Key (KEK)** stored in managed KMS (or customer-managed hardware security module).

## Rotation

* DEK rotation: quarterly, transparent re-encryption

* KEK rotation: annual Customers can opt into customer-managed keys (CMK) for the KEK layer.