Revoke an Encryption Key

When you revoke an active key, Marketing Cloud Engagement deletes the key and you can't log in to your account. Nobody can access the data in your database after revocation.

Save the KeyID, restore token, original RSA 2048 private key, wrapped AES wrapping key, and the wrapped RSA key value used during the key import process. To regain access to your account and your data, use the Restore app to restore the revoked key within two weeks of revoking it. Downtime due to key revocation doesn’t count against any applicable SLA for uptime.

To restore the key, keep a copy of the existing key at the time of revocation and provide that exact value. Keep this value in a safe, secure location. If you can’t provide the exact key value for restoration, all accounts in your organization and all of your data in those accounts remain inaccessible.

Note

This feature is a limited availability program. Contact your account executive for more information about participation in this program. Data at Rest Encryption is a prerequisite for this feature.

1. Hover over your name and click Setup.
2. Type Bring Your Own Key in the search field and click Bring Your Own Key.
3. Click Revoke.
4. Copy the KeyID and the Restore Token values to a separate file. You need these values, in addition to the wrapped AES wrapping key and the wrapped RSA key value, to restore the key. Ensure that you keep these values in a safe place.
5. Review the warning information about the revocation process.
6. Enter the requested phrase and click Revoke and Disable Account.
   To bring a database online, you must restore the revoked key within two weeks. You can’t restore a key after two weeks elapse.