Use one tier model everywhere
Describe key custody consistently as BYOK, CYOK, or HYOK across file, database, mail, calendar, contact, and product data domains.
Vianordis--:--:-- UTCVianordis / ED. 02 / 2026
§ 07 — App support
Velum
Give every tenant data domain one encryption control plane.
Velum provides the shared crypto plane behind Vianordis: tenant-scoped key custody, envelope encryption, per-domain tier policy, grant handling, revocation behavior, and audit events for products that need to protect files, rows, messages, calendars, contacts, and other records.
01 — Problem
Product-by-product encryption creates duplicated risk.
When each application implements its own envelope crypto, KMS routing, grant model, and audit trail, the platform gets inconsistent behavior across files, databases, mail, calendars, contacts, and product-specific stores. Security teams then have to review every management layer separately.
- Key custody language becomes inconsistent across products, especially when BYOK, external KMS, and zero-knowledge modes are mixed.
- Applications duplicate KMS adapters, envelope encryption code, grant logic, and audit paths instead of sharing one reviewed plane.
- Tenant policy is hard to explain when one domain uses provider-held keys, another uses delegated KMS access, and another is zero-knowledge.
- Revocation guarantees are weak if services can fall back to local keys or plaintext paths.
- Changing a domain's encryption posture requires migration planning, but product-specific implementations hide that complexity.
02 — Solution
Velum separates the crypto plane from the management layers.
Velum owns tenant key custody, envelope encryption, DEK lifecycle, grants, revocation checks, availability status, and audit events. Management layers keep their domain models and user experience, but they call Velum rather than implementing their own crypto stack.
- Every operation resolves a tenant, data domain, optional scope, and custody tier before handling plaintext or ciphertext.
- BYOK and CYOK keep full platform-side processing available, while HYOK makes the platform a ciphertext store for supported domains.
- Missing, sealed, unreachable, or revoked keys fail closed with no plaintext fallback.
03 — Benefits
Make encryption posture explainable at platform level.
Velum gives security, compliance, and product teams a common vocabulary and common control plane for how tenant data is encrypted across Vianordis.
Preserve product capability where allowed
BYOK and CYOK allow platform-side scanning, indexing, search, rendering, and domain workflows while still enforcing tenant-scoped keys.
Offer zero-knowledge deliberately
HYOK is available where a customer-side proxy can perform the required processing, so zero-knowledge behavior is explicit rather than implied.
Make revocation concrete
CYOK access revocation causes unwrap operations to fail closed, and HYOK prevents Vianordis from ever receiving plaintext keys.
Reduce crypto duplication
Management layers reuse the same reviewed envelope crypto, KMS routing, grant, rewrap, and audit behavior instead of building separate paths.
Support per-domain policy
Tenants can run different custody tiers simultaneously across domains and, where supported, finer scopes or classifications.
04 — How it works
From domain policy to encrypted record in three steps.
- 01
Resolve the custody policy
Velum receives the tenant, data domain, and optional scope, then selects the configured BYOK, CYOK, or HYOK tier for that operation.
- 02
Handle the DEK lifecycle
The plane generates, wraps, unwraps, rewraps, grants, or revokes per-object or per-record data encryption keys according to the selected tier.
- 03
Encrypt, store, and audit
Payloads are encrypted with envelope crypto, tier metadata is retained with the record, and key events are emitted to the tenant audit stream.
05 — Features
What Velum provides to Vianordis products.
Canonical custody tiers
BYOK covers keys held in Vianordis OpenBao KMS, CYOK covers delegated access to a customer external KMS, and HYOK covers customer-held zero-knowledge keys.
Tenant crypto API
GenerateDEK, UnwrapDEK, Encrypt, Decrypt, RewrapDEK, grant handling, revocation, availability checks, and audit events form one domain-neutral surface.
Per-domain selection
Policy can differ across files, database records, email, calendar, contacts, and other domains, with optional scope or classification overrides.
Fail-closed behavior
Sealed KMS, revoked external access, missing handles, or unavailable key systems return cipher-unavailable errors rather than falling back.
HYOK proxy model
For supported zero-knowledge domains, customer infrastructure performs crypto and necessary processing such as search artifacts or embeddings.
Audit and grants
Key operations, grants, rewraps, and revocations are recorded so tenant security teams can reason about access and custody events.
06 — Architecture
Architecture and operating model.
Velum is a platform service consumed by management layers rather than a user-facing file or database application. It is designed to become the common crypto plane for current and future Vianordis products.
- Management layers such as file services, DAM/catalog services, database-backed products, mail, calendar, and contacts call Velum for crypto operations.
- The custody tier is resolved from tenant, domain, and optional scope policy on every operation and stored with the encrypted object or record.
- BYOK uses Vianordis OpenBao Transit for generated or imported tenant keys.
- CYOK delegates wrap and unwrap operations to a customer external KMS and treats revocation as a hard data-access stop.
- HYOK relies on a customer-side proxy for key handling, encryption, decryption, and any supported domain processing.
- Envelope hierarchy uses tenant CMKs, per-object or per-record DEKs, and AES-256-GCM ciphertext.
- Audit events flow into the platform security monitoring path so key activity remains visible.
07 — Use cases
Where Velum fits.
Tenant-wide encryption posture
Define and explain which domains use platform-held, customer-held, externally delegated, or zero-knowledge key custody.
Regulated customer onboarding
Map procurement or compliance requirements to concrete BYOK, CYOK, or HYOK choices before product rollout.
File and asset encryption
Protect object bytes while preserving the option for customer-side HYOK processing where zero-knowledge asset handling is required.
Database field protection
Encrypt sensitive fields or row blobs while retaining server-side query capability for BYOK and CYOK domains.
Mail, calendar, and contacts
Apply domain-specific custody policies while recognizing where HYOK would limit server-side search, rendering, free/busy, or deduplication.
Customer KMS revocation
Support a verifiable CYOK kill-switch where removing delegated KMS access permanently stops platform decryption.
08 — Integrations
Connects key systems, data domains, and audit paths.
Velum is intentionally domain-neutral so each management layer can keep its model while sharing the same encryption plane.
OpenBao Transit
Controls how protected data is encrypted and who can access the keys.
Customer external KMS
Controls how protected data is encrypted and who can access the keys.
Customer HYOK proxy
Controls how protected data is encrypted and who can access the keys.
Ceph RGW
Provides the governed place where service data and files are stored.
PostgreSQL
Stores structured service records in a controlled tenant-aware backend.
Mail stores
Connects communication records so messages can be used in the governed workflow.
CalDAV
Connects scheduling data so time, meetings, and availability stay part of the workflow.
CardDAV
Connects address-book data so people and organizations remain visible in context.
Object storage
Provides the governed place where service data and files are stored.
Wazuh / SIEM
Creates reviewable records so important activity can be investigated later.
Keycloak
Keeps access tied to organization accounts, roles, and sign-in policy.
mTLS
Shows how this service fits into the wider Vianordis environment instead of standing alone.
REST API
Lets approved systems connect without ad hoc exports or manual copy-paste.
09 — Trust
Security guarantees and constraints.
Velum makes the guarantees explicit: tenant isolation, envelope crypto, per-domain policy, fail-closed behavior, and audit events. HYOK is offered where the corresponding domain can support customer-side processing.
Tenant isolation
Keys and DEKs are scoped to one tenant, and cross-tenant key use is not part of the model.
Envelope crypto
Per-tenant CMKs wrap per-object or per-record 256-bit DEKs used for AES-256-GCM payload encryption.
Provider plaintext
BYOK and CYOK allow platform processing; HYOK does not expose plaintext to Vianordis.
Revocation
CYOK customer KMS revocation stops unwrap operations and fails closed rather than creating a fallback path.
Policy granularity
Tier selection is per data domain and may support finer scopes or classifications where a domain implements them.
Migration reality
Changing an existing domain's custody tier requires re-encryption of existing data.
10 — Pricing
Velum tiers are priced as platform encryption posture.
Velum BYOK is included with every plan. CYOK is listed at €12 per user per month for customer external KMS delegation, and HYOK is listed at €39 per user per month for supported zero-knowledge domains that require customer-side proxy operation.
11 — FAQ
Questions technical buyers usually ask.
Is Velum replacing DAM?
No. Velum replaces product-specific encryption, KMS routing, and audit logic. DAM or asset catalog services keep their catalog, metadata, search, and embedding value while calling Velum for storage crypto.
What are the three tiers?
BYOK uses a tenant key in Vianordis OpenBao KMS, generated by the platform or imported by the customer. CYOK keeps the root key in a customer external KMS with delegated access. HYOK keeps keys customer-side and makes Vianordis a ciphertext store for supported domains.
Can one tenant use multiple tiers?
Yes. A tenant can run BYOK for one domain, CYOK for another, and HYOK for a supported zero-knowledge domain at the same time.
Why is HYOK not always available?
HYOK removes platform access to plaintext. Any required processing, such as search, malware scanning, rendering, free/busy calculation, or indexing, must happen in the customer's proxy or be unavailable.
What happens if CYOK access is revoked?
Velum fails closed. If the customer KMS no longer unwraps the DEK, Vianordis cannot decrypt the corresponding data and does not fall back to another key.
Can an existing domain change tiers?
Yes, but existing records need a re-encrypt migration so each object or record stores the correct tier and wrapped key material.
12 — Next step
Turn key custody from a product exception into a platform control.
See how Velum can map your tenant domains to BYOK, CYOK, and HYOK policies while keeping encryption behavior consistent across Vianordis.