Glossary
BYOK (bring your own key)
BYOK (bring your own key) means a customer supplies their own key to a software service: an encryption key they control in a key management service, or an API key for an AI model provider so model usage runs on their own account.
What Is BYOK (Bring Your Own Key)?
In short In cloud security, BYOK means you create the encryption key that protects your data in a cloud service, import it into the provider's key management service (KMS) and keep control of it.
AWS KMS, for example, lets you import your own key material, a feature AWS says is often known as BYOK. The flip side is responsibility: IBM notes that without a valid master key, data can become permanently inaccessible.
In AI software, BYOK means you enter your own API key from a model provider such as OpenAI, Anthropic or Google, and the tool calls the model on your account. You pay the provider directly, choose the model and keep usage under your own provider terms and limits. GitHub Copilot, for example, lets users bring their own model provider keys.
BYOK Example
For example, a team personalizes 20,000 emails a month at about 1,500 tokens each, roughly 30 million tokens. With BYOK, those tokens bill to the company's own model provider account under its existing data terms, and finance sees AI spend on one invoice instead of spread across several sales tools.
BYOK in Practice
For sales and RevOps teams, AI BYOK matters at volume. Personalizing tens of thousands of emails or classifying every reply runs millions of tokens a month, and BYOK puts that cost on an existing provider contract where you can see it. Encryption BYOK comes up in security reviews of vendors that store customer data, often next to a request for a SOC 2 report.
FAQ
What does BYOK mean?
Bring your own key. In cloud security it means supplying and controlling your own encryption keys. In AI tools it means using your own model provider API key instead of the vendor's.
What is the difference between BYOK and HYOK?
With BYOK you import your key into the cloud provider's key management service. With HYOK (hold your own key) the key stays entirely in your own environment, which gives more control and more operational work.
Is BYOK more secure?
It gives you more control: you can rotate or revoke the key, and revoking it cuts off access to the encrypted data. It also makes you responsible for the key, and losing it can make the data permanently unreadable.
Why do AI tools offer BYOK?
So you can use your own model provider account: pick the model, pay the provider directly and keep usage under your own terms. Treat the key like a password and keep it in a secret manager, not in shared code.
Do This in Ken
Do This in Ken
Bring your own keys lets you connect your own provider API keys to Ken.
- Module
- Bring your own keys
- Open in Ken
- /pricing
The new Ken opens to the waiting list in batches.
Related
- GTM Glossary
Every GTM term, grouped by topic.
- LLM (large language model)
- SOC 2
- API (application programming interface)
- AI agent
- Ken pricing
Sources
| Source | Checked |
|---|---|
| IBM: What is BYOK? | |
| AWS KMS Developer Guide: Importing key material | |
| GitHub Docs: Bring your own key |
Changelog
- Page published.