Home > Tenant configuration > Tenant encryption review
Tenant encryption review
Last updated: 2026-11-03Cadence: Yearly
Subscription model: All (CMK customers only)
Roles: Tenant Admin (TA)
Last verified: 2026-05
| Initial | Recurring | |
|---|---|---|
| Estimated time | 2 hr | 1 hr |
Benefits:
- Aligns Qlik tenant encryption with the organization's KMS rotation schedule
- Confirms KMS access policies are still appropriate
- Catches expired or reissued KMS keys before they cause data-access failures
Goal
If the tenant uses a customer-managed key (CMK) via AWS KMS (the only external KMS provider Qlik supports for CMK—GCP KMS and Azure Key Vault aren't options), tenant encryption requires periodic review and rotation per your organization's key-management policy. The yearly review aligns Qlik tenant encryption with your broader KMS posture.
Tasks
| Task | TA | AA | DA | AuA |
|---|---|---|---|---|
| Review CMK rotation schedule and KMS access policies | ✓ | |||
| For new CMK provider configurations, use an AWS KMS multi-region key—the Encryption API requires multi-region keys for new configurations. Existing single-region configurations aren't forced to migrate except when rotating to a new key, which triggers the multi-region requirement. Sovereign regions with data-sovereignty restrictions still permit single-region keys (DR isn't available there) | ✓ |
References
Tags: #yearly #tenant_configuration #encryption #cmk #kms