--- title: "Who holds the key holds the data" url: https://blog.hivault.eu/en/who-holds-the-key-holds-the-data language: en published: 2026-11-01T07:00:00Z updated: 2026-11-02T06:14:43Z tags: ["encryption keys", "data sovereignty", "GDPR", "secrets management"] --- # Who holds the key holds the data > Encryption is only as strong as the keys behind it. Why hosting in the EU is not enough, what European law says, and five questions to ask a provider before you hand over your secrets. Encryption is standard practice today. Data at rest is encrypted, connections are encrypted, backups are encrypted. Yet many organisations cannot answer a simple question: **who holds the key?** The answer decides whether encryption really protects data against unauthorised access, or merely improves the result of an audit. ## Encryption moves the problem to the keys Encrypted data without the key is useless. With the key, it is fully readable. Protecting data therefore comes down to protecting keys: where they are stored, who can use them, who can read them, and what happens when you change provider. If a cloud provider encrypts data for you and manages the keys itself, it can still technically decrypt that data. It does not have to, but it **can**. And whatever a provider can do, it can also be compelled to do. ## Where the servers are is not enough We often hear that data "stays in the EU" because the data centre is in Frankfurt or Warsaw. That matters, but it does not settle who controls the data. What counts is not only the address of the server room but also **under what jurisdiction the entity that manages the data and the keys operates**. The US CLOUD Act of 2018 allows US authorities to demand data from providers subject to US law even when the data is stored outside the United States. For an EU company, this creates tension between GDPR obligations and requests a provider may receive under another legal order. ## What European law says Three reference points: - **The Schrems II judgment (16 July 2020).** The Court of Justice of the EU invalidated the Privacy Shield and stressed that transferring data to a third country requires an essentially equivalent level of protection, not just formal assurances. - **EDPB Recommendations 01/2020.** The European Data Protection Board described supplementary measures, including encryption. Particularly relevant is the scenario where data is encrypted before transfer and the keys remain solely under the control of an entity in the EEA (or in a country with an adequacy decision), with no access for the provider. - **The EU-US Data Privacy Framework.** In 2023 the European Commission found that participants in this framework provide an adequate level of protection. On 3 September 2025 the EU General Court dismissed Philippe Latombe's challenge to that decision, but he appealed to the Court of Justice on 31 October 2025. This dispute shows that the legal framework for transfers to the US is not settled once and for all. The conclusion is not to "never use a provider outside the EU". It is: **an architecture where the keys stay under your control is more resilient to changes in the law than one based solely on trust in a provider.** ## Five questions to ask a provider before you hand over your secrets 1. **Who holds the root key?** Can you generate and store it yourself? Does the provider have any technical ability to decrypt your data at all? 2. **Where, and under which jurisdiction, does the provider operate?** Ask about the legal entity, its parent companies and subcontractors, not only about the data centre location. 3. **What happens when an authority makes a request?** Does the provider have a procedure, do they notify the customer, and do they challenge overly broad requests? Can it hand over anything apart from encrypted data? 4. **What are audits like?** Is access to keys and secrets logged, and can you read and retain that log on your side? 5. **What does exit look like?** Can you export secrets and keys in an open format, without depending on a single provider? Rotation and key recovery are part of the design, not an add-on. ## What encryption does not solve Keeping keys under your control does not replace the rest of security hygiene. You still need limited privileges, secret rotation, environment segmentation and access control. Well-designed key management simply lets all of these measures rest on one foundation you can verify. ## Why we are writing about this We are working on hiVault, a secrets and key management solution designed in Europe on the assumption that control over keys should remain with the customer. On this blog we will describe how we approach such design decisions, along with the trade-offs they bring. To follow the project, visit [hivault.eu](https://hivault.eu) or subscribe to the [blog's RSS feed](/en/feed.xml). ## Sources - [CLOUD Act (H.R. 4943, 115th US Congress)](https://www.congress.gov/bill/115th-congress/house-bill/4943) - [CJEU judgment in Case C-311/18 (Schrems II)](https://curia.europa.eu/juris/liste.jsf?num=C-311/18) - [EDPB, Recommendations 01/2020 on supplementary measures to transfer tools](https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer-tools_en) - [WilmerHale: Court of Justice to review challenge to the EU-US Data Privacy Framework (1 Dec 2025)](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework) *This article is for information purposes only and is not legal advice.*