# How WorkOS Vault's local encryption works

DevFeed: [How WorkOS Vault's local encryption works](<https://devfeed.tech/articles/how-workos-vault-s-local-encryption-works-17464.md>)

Original publisher: [Read original article](<https://workos.com/blog/how-vault-local-encryption-works>)

Author: WorkOS

Published: 2026-09-14T00:00:00Z

Content type: article

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Encryption](<https://devfeed.tech/topics/encryption.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Security](<https://devfeed.tech/topics/security.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [data](<https://devfeed.tech/tags/data.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [pii](<https://devfeed.tech/tags/pii.md>), [security](<https://devfeed.tech/tags/security.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

The article explains how WorkOS Vault performs local encryption using envelope encryption. Each operation uses a single-use data encryption key, which is protected by a key encryption key stored in a hardware security module. Sensitive plaintext and ciphertext remain within the customer's infrastructure; only the wrapped key is sent to WorkOS. Key contexts automatically select or create isolated keys for organizations or tenants, with support for customer-managed keys and documented limits on context size and key counts.

## Source excerpt

Envelope encryption, data keys, and why your sensitive data never has to leave your infrastructure