Security & Trust Center
Your data security is our top priority
Multi-Key Protection: Encrypting your data at rest within Databricks
Databricks Multi-Key Protection is a key encryption hierarchy that implements fine-grained encryption of customer data when it is at rest in the Databricks account.
Currently, Databricks has implemented Multi-Key Protection to securely encrypt customer data at rest in Default Storage, a Databricks-managed cloud storage solution designed for customers who prefer a simpler data lakehouse infrastructure, available now to customers starting with express setup.
What is Databricks Multi-Key Protection?
Databricks Multi-Key Protection is a key encryption hierarchy that secures data at rest in the Databricks account with multiple levels of isolation and the ability to provide a customer-managed key (CMK).
Encryption process
1. Databricks maintains a Databricks-managed key (DMK) that serves as the root of our encryption hierarchy.
2. Optional: A customer can provide a customer-managed key (CMK) that encrypts the root of their key hierarchy. If revoked, data becomes undecryptable to any Databricks process.
3. The DMK is used with the CMK (if provided) to encrypt individual catalog keys in Unity Catalog.
4. Object-level keys are created for objects within that catalog, such as table keys, volume keys and model keys. Those keys are encrypted with the catalog key.
5. The ephemeral keys that encrypt actual data files are created based on the object key. These file-level keys are always derived in-memory on trusted compute and are not persisted to disk.