BYOK / CMEK

Bring-your-own-key (P8 Variant A). Your CMK wraps the Tenant Key. Revoking the grant on your CMK renders this tenant's data undecryptable within 30s — this is intentional and cannot be undone without re-binding.

Set TENANT_ADMIN_TENANT_ID in this app's env to view your binding.