Bring Your Own Key (BYOK) comes to Europe
For European organizations, keeping sensitive data under control can be an organizational requirement.
After launching Bring Your Own Key (BYOK) in North America, we're now expanding BYOK to Europe, for organizations hosting Jamf Pro in the Jamf Cloud in Frankfurt, Germany.
What is BYOK? How does BYOK work?
Bring Your Own Key, also known as CMK (Customer Managed Keys), lets customers provide and manage their own encryption keys for data stored in Jamf Cloud. Jamf already encrypts data at the disk and application level. BYOK goes a step further, putting the application-level encryption key itself in your hands rather than ours. It allows you to generate a key using your own key management system, and Jamf's cloud-hosted services use that key to encrypt and decrypt your data.
BYOK integrates with four key management systems you may already run:
For more details, read our introductory blog on BYOK and dive into technical details in product documentation.
Built for customer control
BYOK was designed with regulated industries in mind. BYOK changes who controls the encryption key for your sensitive data. The key for your data stays in your key management system, and you control Jamf’s access to it. If you revoke that access, Jamf’s ability to read or operate on that encrypted data is removed.
A few things worth calling out:
- Hosted in Frankfurt. BYOK in Europe runs out of our Frankfurt hosting region. If your organization is based in the UK or elsewhere in Europe and wants to use BYOK, you may need to migrate your Jamf Cloud hosting to this region.
- It currently covers Jamf Pro and Declarative Device Management (DDM) data. At launch, this service is available to protect data in these two portions of the Jamf platform, with expansion to additional Jamf solutions hosted are planned for the future.
- It's about control, not just compliance. Auditors and regulators need to see that the right controls are in place. Your security team cares about something more basic: does anyone at Jamf have a way to decrypt and read our sensitive data without us knowing? What BYOK prevents is anyone except for the application reading sensitive data, and it lets the customer cut off access entirely by revoking the key.
Get started
BYOK is available now for new and existing customers hosting their Jamf instances in Jamf Cloud's Frankfurt datacenter, excluding Jamf Premium Cloud Plus or StateRAMP environments. To find out whether Jamf is right for your organization, reach out to your Jamf representative to discuss eligibility.
Not with Jamf yet? Request a free trial today.
