Platform & DevOps·Secrets, identity and the supply chain
the key never leaves the service; you send it data to encrypt and it sends the result back, logging every call.
Key management service
Also calledKMS, key vault, HSM-backed keys
A managed service that holds cryptographic keys and performs operations with them, so the key material is never exposed to callers. Its access policy becomes the actual boundary on the data it protects, which means deleting or losing access to a key is equivalent to deleting the data. Scheduled key deletion has a waiting period for exactly that reason, and it is one of the few genuinely irreversible cloud operations.