---
title: "Infino Cloud adds bring-your-own-bucket and customer-managed keys"
description: "Infino Cloud adds two enterprise-grade controls: host a database in your own S3, GCS or Azure bucket, and encrypt it with a key only you control in your own cloud KMS, so your data stays in your account and you can revoke access independently."
canonical: https://infino.ai/blog/enterprise-byob-and-customer-managed-keys/
published: 2026-10-28
---

# Infino Cloud adds bring-your-own-bucket and customer-managed keys

Oct 28, 2026 · engineering

Teams that run retrieval over sensitive data have two questions before anything else: where does the data live, and who holds the key to it. Today Infino Cloud adds two enterprise-grade capabilities that answer both, bring your own bucket (BYOB) and customer-managed encryption keys (CMEK), on Amazon S3, Google Cloud Storage and Azure Blob Storage. Together they mean your data never leaves your account, and only you hold the key that decrypts it.

## Your data stays in your bucket

By default an Infino Cloud database stores its data in Infino's object storage, isolated by prefix. With BYOB you point the database at your own bucket instead. Everything Infino writes, the index and its Parquet data, lands in your account, in your region, under your lifecycle and access policies. Infino runs the control plane and the serving layer on top. The durable copy is standard Parquet that any reader can open, sitting where your governance already applies.

Infino reaches the bucket through a single identity you authorize: an IAM role it assumes on AWS, a service account you grant on GCS, or an application you consent on Azure, scoped to that bucket and nothing else. You can revoke that access at any time, independently of Infino. Setup is a short, one-time grant per database, and the [Bring Your Own Bucket](https://infino.ai/docs/cloud/bring-your-own-bucket) guide walks through it for each cloud.

## Encrypted with a key only you control

BYOB puts the data in your account. CMEK puts the key in your hands. You encrypt the bucket with a customer-managed key in your own cloud KMS, AWS KMS, Google Cloud KMS or Azure Key Vault, and grant Infino's identity only the right to use it: wrap a data key on write, unwrap it on read, nothing more. Infino never holds your key material, cannot export the key, and cannot use it for anything but your bucket.

Because the key is yours, the controls are yours. Disable it, or remove Infino's grant, and the database becomes unavailable to Infino within one access-refresh interval. Infino stops serving it and clears any cached copy, rather than falling back to a weaker key. Re-enable the key and re-verify, and serving resumes with no data lost. And if you let the key's deletion complete, the data encrypted under it becomes permanently unreadable by everyone, Infino included, a hard kill switch you hold by design. The [Customer-Managed Encryption Keys](https://infino.ai/docs/cloud/customer-managed-keys) guide covers the setup and exactly what each action does.

## Why it matters

The point of Infino Cloud is one copy of your data that search, vectors and SQL all run over, without standing up and harmonizing three separate systems. BYOB and CMEK extend that to the teams who could not put that copy on someone else's storage under someone else's key: regulated industries, government, and anyone whose data governance starts with keeping data in their own account. You keep the data and the key. Infino provides the retrieval over it.

❯ infino init

Your data in your bucket, your key in your KMS, and retrieval that runs over it.

[Get started for free](https://platform.infino.ws/signup?utm_source=infino.ai\&utm_medium=inline-cta\&utm_campaign=cloud-signup\&utm_content=enterprise-byob-cmek) [Talk to an engineer](https://infino.ai/talk/)

Free tier · No credit card to start

Guides: [bring your own bucket](https://infino.ai/docs/cloud/bring-your-own-bucket) · [customer-managed keys](https://infino.ai/docs/cloud/customer-managed-keys).