SAP Key Management Service

Take control of your business data using your own encryption keys.
Key configuration details screen in SAP Key Management Service.

What is SAP Key Management Service?

SAP Key Management Service is a security service that safeguards data with customer-controlled encryption keys and compliant key management across your SAP cloud solutions.

placeholder

Meet data protection and audit requirements with:

  • Cloud deployment.

  • Simplified and transparent custom key management.

  • Intuitive user experience.

  • Better compliance within business regulations.

  • Adaptive and scalable capabilities.

Key benefits

Enhance security and resilience

Limit provider and insider access with exclusive key control and quickly revoke or rotate keys for swift incident containment and secure offboarding.

Ensure compliance goals

Streamline audits and certifications by using proven key custody, hardware security module-backed (HSM) controls, and clear separation of duties.

Lower overhead

Reduce operational efforts, errors, and total cost of ownership using a centralized, automated key lifecycle.

Adopt cloud services confidently

Use SAP cloud services while maintaining data sovereignty and a consistent, high-assurance security posture.

Key features

placeholder

Enhance security

  • Import, register, enable, disable, rotate, and delete keys within your secure SAP KMS tenant.

  • Lock SAP cloud systems to immediately prevent data access.

  • Enforce dual control and workflow approvals for key operations.

  • View policies, status, and audit logs through a central management UI.

  • Protect key handling with a cryptographic keychain.

Meet your compliance goals

  • Trace all key activities using audit logs.

  • Authenticate using cloud identity services.

  • Ensure regulatory compliance with FIPS-validated and HSM-backed key storage.

  • Enforce least privilege-access through role-based access control.

  • Control SAP system-to-key mapping.

Improve flexibility

  • Import, register, and store keys using bring your own key (BYOK) or hold your own key (HYOK).

  • Support centralized or distributed SAP KMS models.

  • Dynamically assign and update customer-managed key mappings.

  • Connect SAP cloud solutions to designated SAP KMS tenants.

  • Operate across all major hyperscalers.

Technical and security resources

SAP Help Portal

Visit SAP Help Portal to find detailed documentation, guides, and articles to help you implement, configure, and optimize SAP products.

Data security

Learn how SAP helps you protect your data's integrity, availability, and confidentiality.

Explore data security 

Trust

Discover how SAP builds trust through transparency, accountability, and secure cloud operations.

Explore SAP Trust Center 

Compliance

Learn how SAP supports your compliance needs with certifications, attestations, and audit-ready reports.

Explore compliance 

Get started

Jump-start your implementation and drive ROI by collaborating with industry experts, consultants, and support engineers throughout your journey.

Services

Transform your business quickly and effectively by taking advantage of our holistic service and support plans, expert consulting services, custom application development, proven best practices, and deep industry and technical knowledge.

Explore our services 

Support

Help keep your SAP solutions running at peak performance with our IT experts and support services, including long-term plans, embedded teams, remote technology support, self-service portal, and innovation strategies.

Visit the support portal 

Additional solutions

Explore additional offerings related to SAP Key Management Service.

SAP Risk and Assurance Management

Document and link risks and internal controls, automate controls, and assess business impact.

Explore the product
SAP Cloud Identity Access Governance

Govern access authorizations with greater ease and minimize mistakes, misuse, and financial loss.

Explore the product
SAP Datasphere

Simplify your data landscape with access to trusted, context-rich business data across SAP and third-party systems.

Explore the product

Frequently asked questions

SAP Key Management Service (SAP KMS) is a security service that allows customers to manage their own encryption keys for SAP cloud products and the SAP Business AI Platform to protect data at rest. It provides consistent key governance and auditability to help meet compliance and regulatory requirements. With SAP KMS, customers keep control of their encryption keys, ensuring data remains inaccessible to any external party.

Customer-managed encryption means that you, the customer, control the encryption keys that protect your data at rest in SAP cloud services. With SAP KMS, you decide who can access your data and when. Revoke a key, and the data becomes inaccessible to anyone, including SAP. This gives your organization full sovereignty over sensitive data and helps meet compliance requirements such as GDPR and CCPA. Options include bring your own key (BYOK) and hold your own key (HYOK).

A cryptographic key is the secret value used to encrypt and decrypt your data. Think of it as a digital lock—only someone with the right key can access the information it protects. In SAP cloud services, every piece of data at rest is secured by one of these keys. By default, SAP generates and manages the keys for you. With SAP Key Management Service (SAP KMS), you take over that control by creating, rotating, and revoking your own keys so your data stays inaccessible to anyone you haven't authorized.

SAP Key Management Service (SAP KMS) protects your business data by putting encryption key control in your hands. Generate, rotate, and revoke your own keys across SAP cloud products and the SAP Business AI Platform. If a key is revoked, the data it protects becomes cryptographically locked to everyone. SAP KMS also provides consistent key governance and auditability to help you meet compliance and regulatory requirements, giving your organization a proactive, centralized approach to data security.

With bring your own key (BYOK), you generate your encryption key and import it into SAP Key Management Service (SAP KMS). Your key lives inside SAP's secure environment, but you—not SAP—create and control it. With hold your own key (HYOK), your key never leaves your infrastructure. SAP KMS connects to your external keystore and requests permission to use it. If you cut access, the data is immediately inaccessible. BYOK offers control with easier cloud integration. HYOK offers maximum sovereignty for stricter security requirements.

Many regulations, including GDPR and PCI DSS, require organizations to protect sensitive data, control who can access it, and prove that controls are in place. SAP Key Management Service (SAP KMS) helps you meet those requirements in three ways: it gives you full control over your encryption keys, supports consistent key governance across SAP cloud products, and provides auditability so you can demonstrate compliance. Regular key rotation, access revocation, and flexible key scenarios like bring your own key (BYOK) and hold your own key (HYOK) add further layers of accountability.

SAP Key Management Service (SAP KMS) manages encryption keys across their full lifecycle. You start by generating a key, which SAP KMS stores securely and distributes to the services that need it. When you rotate a key, a new primary version encrypts the keychain while the older version stays active to decrypt existing data. When a key is no longer needed, you can disable or delete it, immediately blocking access to the data it protects. Every step is logged for full auditability.

When using bring your own key (BYOK), SAP Key Management Service (SAP KMS) relies on a FIPS 140-2 Level 3 compliant hardware security module (HSM) for key storage. This means the physical device that stores your encryption keys has passed rigorous testing to validate its security mechanisms. For organizations in regulated industries, this provides a verified, standards-backed foundation for BYOK key storage.