Follow Discord
Sweep 27 Oct 2026 · 19:04Z Build v2.1.312 531 read Stable v2.1.308 Latest v2.1.312 Next v2.1.312 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Developer Platform 27 Oct 2026
One change · api

cmek-how-it-works changedmanage-claude/cmek-how-it-works

Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here
Lines+5added
Lines−5removed
From line 14 where the diff opens
First seen 23 Oct 2026 this site's first read of the page
Recorded edits3to this page, all time

The whole hunk

from line 14, old and new numbered
/
lines
from line 14
1414 ![Your key stays in your cloud's KMS and wraps Anthropic's data keys, which encrypt your data. Your cloud can log each call.](https://platform.claude.com/docs/images/cmek/key-wrapping.svg)
1515</Frame>
1616 
17Anthropic keeps no copy of your key, so without it, Claude [can't read the data it protects](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle).
17Anthropic keeps no copy of your key, so without it, Claude [can’t read the data it protects](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle).
1818 
1919## What one key protects
2020 
from line 32
3232 
3333## When your key takes effect
3434 
35Your key protects only data written after it takes effect. Existing data (prior chats, files, and sessions) stays under Anthropic's key and isn't re-encrypted.
35Your key protects only data written after it takes effect. Existing data (prior chats, files, and sessions) stays under Anthropic’s key and isn’t re-encrypted.
3636 
37On Claude Platform and Claude Platform on AWS, a key attached to a workspace before its first request takes effect with that request. In a workspace in use, your key can take up to a day to take effect, and data written meanwhile stays under Anthropic's key. That's why Anthropic recommends a new workspace.
37On Claude Platform and Claude Platform on AWS, a key attached to a workspace before its first request takes effect with that request. In a workspace in use, your key can take up to a day to take effect, and data written meanwhile stays under Anthropic’s key. That’s why Anthropic recommends a new workspace.
3838 
3939## What you can see
4040 
41Your cloud's audit log can record every operation Anthropic performs with your key. Where you have to turn that logging on, your setup page lists it as a prerequisite. In AWS CloudTrail, some entries are [expected errors](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cloudtrail).
41Your cloud’s audit log can record every operation Anthropic performs with your key. Where you have to turn that logging on, your setup page lists it as a prerequisite. In AWS CloudTrail, some entries are [expected errors](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cloudtrail).
4242 
43Changes to your CMEK configuration appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). Key operations don't.
43Changes to your CMEK configuration appear in the [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed). Key operations don’t.
4444 
4545## Latency and standards
4646 
Feedback