> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parable.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Encryption

> Customer-Managed Encryption Keys — rotate, revoke, and audit the keys that protect your Workspace data.

<Info>
  Customer-Managed Encryption Keys (CMEK) is available on Enterprise plans.
  Contact [support@askparable.com](mailto:support@askparable.com) to enable it
  for your organization.
</Info>

By default, Parable encrypts your data at rest using Google-managed keys. With
CMEK, you control the encryption keys that protect your data. The keys live in
**your** Google Cloud KMS keyring inside Parable's GCP project.

<Columns cols={2}>
  <Card title="Rotate keys" icon="arrows-rotate">
    Generate new key versions on your schedule. New data uses the latest
    version; existing data stays readable under previous versions.
  </Card>

  <Card title="Disable access" icon="ban">
    Disable your key to immediately revoke Parable's ability to decrypt your
    data — even in an emergency.
  </Card>

  <Card title="Audit every operation" icon="clipboard-list">
    Google Cloud Audit Logs record every encrypt and decrypt with identity
    context.
  </Card>

  <Card title="Schedule destruction" icon="clock">
    Schedule key versions for destruction after a 24-hour waiting period
    (GCP-enforced).
  </Card>
</Columns>

## What Parable controls vs. what you control

|                      | Parable                                                                                             | You                                                                 |
| -------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| KMS keyring creation | Created during provisioning                                                                         | —                                                                   |
| Keyring location     | Set to your data region                                                                             | —                                                                   |
| Key rotation         | Automatic every 90 days on `main`                                                                   | Can trigger anytime                                                 |
| Encrypt / decrypt    | Application service accounts use the keys                                                           | —                                                                   |
| Key disable / enable | Infrastructure admins retain operational access and will not act without your written authorization | Can disable or enable at any time                                   |
| Key destruction      | Same written-authorization rule                                                                     | Can schedule destruction                                            |
| Audit log access     | Internal monitoring                                                                                 | Read-only access to your keyring's audit logs via a scoped log view |

<Warning>
  Disabling your key immediately stops Parable from accessing your data.
  Ingestion jobs fail and dashboards return errors until you re-enable the key.
  See Incident response below.
</Warning>

## Your keyring

When Parable provisions your Workspace, we create a dedicated KMS keyring in
Parable's GCP project. You receive IAM access to that keyring only.

* **Keyring name:** `tenant-{your-slug}-kms` — `{your-slug}` is your Workspace
  slug.
* **Location:** Same region as your data (for example `us-east1`).
* **Keys:**
  * `main` — Symmetric key for data at rest. Auto-rotates every 90 days
    (`7776000s`).
  * `credential-encryption` — Asymmetric key for Provider credentials in
    transit.
  * `content-encryption` — Asymmetric key for desktop-agent content. Provisioned
    on every Workspace keyring.

Sign in to GCP Console with **corporate SSO** (recommended) or a **Google
account**. During onboarding, Parable configures the method and sends direct
links to your keyring and audit logs.

<Tabs>
  <Tab title="SSO setup">
    Your IT admin creates an SSO application so your team can reach GCP Console
    to manage keys and view audit logs.

    <Info>
      Parable provides the values marked as from Parable during onboarding. If
      you do not have them yet, contact
      [support@askparable.com](mailto:support@askparable.com).
    </Info>

    Most identity providers support OIDC and SAML. Use OIDC unless your
    organization requires SAML.

    <Tabs>
      <Tab title="OIDC">
        Create a custom OIDC application:

        | Setting               | Value                                                 |
        | --------------------- | ----------------------------------------------------- |
        | App name              | `Parable CMEK Access` (or any name your team prefers) |
        | Redirect URI          | Provided by Parable                                   |
        | Login URL             | Provided by Parable                                   |
        | Grant type            | Authorization Code                                    |
        | Client authentication | Client Secret Basic                                   |
        | Scopes                | `openid`, `profile`, `email`                          |

        <Steps>
          <Step title="Create the OIDC application">
            In your IdP admin console, create a custom OIDC application. Enter
            the Redirect URI and Login URL from Parable.
          </Step>

          <Step title="Assign users or groups">
            Assign the people who should manage keys. You can add or remove
            them later without contacting Parable.
          </Step>

          <Step title="Send credentials to Parable">
            Share Client ID, Client Secret, and Issuer URL (for example
            `https://your-org.okta.com/` or
            `https://oauth.id.jumpcloud.com/`) through a secure channel.
          </Step>

          <Step title="Parable completes configuration">
            Parable sends a GCP Console sign-in link, a keyring link, and an
            audit-log link. Your team can also open GCP from the app in your
            IdP portal.
          </Step>
        </Steps>

        <AccordionGroup>
          <Accordion title="Okta">
            1. Applications → Create App Integration → OIDC - OpenID Connect →
               Web Application
            2. Set the Sign-in redirect URI to the Redirect URI from Parable
            3. Assign users or groups
            4. Copy Client ID and Client Secret from the General tab
            5. Issuer URL is `https://your-org.okta.com/`
          </Accordion>

          <Accordion title="Microsoft Entra ID">
            1. App registrations → New registration
            2. Set the Redirect URI (Web) to the Redirect URI from Parable
            3. Certificates & secrets → create a client secret
            4. Copy Application (client) ID and the secret value
            5. Issuer URL is
               `https://login.microsoftonline.com/{tenant-id}/v2.0`
          </Accordion>

          <Accordion title="JumpCloud">
            1. SSO Applications → Add New Application → Custom OIDC App
            2. Set Redirect URI and Login URL from Parable
            3. Client Authentication Type: Client Secret Basic
            4. Check Email and Profile under Standard Scopes
            5. Assign your test user or group
            6. Copy Client ID and Client Secret
            7. Issuer URL is `https://oauth.id.jumpcloud.com/`
          </Accordion>
        </AccordionGroup>
      </Tab>

      <Tab title="SAML 2.0">
        Create a custom SAML application:

        | Setting                 | Value                                                 |
        | ----------------------- | ----------------------------------------------------- |
        | App name                | `Parable CMEK Access` (or any name your team prefers) |
        | SP Entity ID (Audience) | Provided by Parable                                   |
        | ACS URL (Reply URL)     | Provided by Parable                                   |
        | Login URL               | Provided by Parable                                   |
        | NameID Format           | Email or Persistent                                   |

        <Warning>
          The SAML application must enable HTTP-Redirect binding. GCP requires
          it for browser SSO. In most IdPs this is "Declare Redirect Endpoint"
          or "Enable HTTP-Redirect binding."
        </Warning>

        <Steps>
          <Step title="Create the SAML application">
            Enter the SP Entity ID, ACS URL, and Login URL from Parable.
            Enable HTTP-Redirect, not only HTTP-POST.
          </Step>

          <Step title="Assign users or groups">
            Assign the people who should manage keys.
          </Step>

          <Step title="Send metadata to Parable">
            Share your IdP Metadata XML as a metadata URL (preferred) or a
            downloadable XML file.
          </Step>

          <Step title="Parable completes configuration">
            Parable sends a GCP Console sign-in link, a keyring link, and an
            audit-log link.
          </Step>
        </Steps>

        <AccordionGroup>
          <Accordion title="Okta">
            1. Applications → Create App Integration → SAML 2.0
            2. Single sign-on URL = ACS URL from Parable
            3. Audience URI (SP Entity ID) = SP Entity ID from Parable
            4. Advanced Settings: Response = Signed
            5. Assign users or groups
            6. Copy the Metadata URL from the Sign On tab
          </Accordion>

          <Accordion title="Microsoft Entra ID">
            1. Enterprise applications → New application → Create your own
               application → Non-gallery
            2. Single sign-on → SAML: Identifier = SP Entity ID, Reply URL =
               ACS URL
            3. Download Federation Metadata XML
            4. Assign users or groups
          </Accordion>

          <Accordion title="JumpCloud">
            1. SSO Applications → Add New Application → Custom SAML App
            2. IdP Entity ID = a unique identifier
            3. Set SP Entity ID and ACS URL from Parable
            4. Enable Declare Redirect Endpoint
            5. Assign your test user or group
            6. Copy the Metadata URL from the SSO tab
          </Accordion>
        </AccordionGroup>
      </Tab>
    </Tabs>

    After federation: you control access in your IdP, no Google account is
    required, and federated users do not accept a separate Google Terms of
    Service. To change IdP or rotate credentials, contact
    [support@askparable.com](mailto:support@askparable.com).
  </Tab>

  <Tab title="Key management">
    <Steps>
      <Step title="Sign in to GCP Console">
        Use the federated sign-in link from onboarding, or sign in at
        [console.cloud.google.com](https://console.cloud.google.com) with a
        Google account. If you do not have the link, contact
        [support@askparable.com](mailto:support@askparable.com).
      </Step>

      <Step title="Open your keyring from the onboarding link">
        Your access is scoped to your keyring. You cannot list other
        customers' keyrings.
      </Step>

      <Step title="Verify your keys">
        You should see `main`, `credential-encryption`, and
        `content-encryption`.
      </Step>
    </Steps>

    ### Rotate

    Rotation creates a new key **version**. Existing data stays readable. GCP
    tracks which version encrypted each object.

    <Steps>
      <Step title="Select the key">
        Open the `main` key.
      </Step>

      <Step title="Rotate the key">
        Click **Rotate key**, then confirm.
      </Step>

      <Step title="Verify the new version">
        The new version is **Primary**. Previous versions stay **Enabled**.
      </Step>
    </Steps>

    <Info>
      Parable rotates `main` every 90 days. Manual rotation adds a version
      early and does not reset that timer. `credential-encryption` and
      `content-encryption` do not auto-rotate.
    </Info>

    ### Disable

    Disabling a version blocks encrypt and decrypt for data under that version.

    <Warning>
      Disabling the primary version stops Parable services immediately. Only
      do this if you intend to stop all data access.
    </Warning>

    Open the key, use the three-dot menu on the version row, and choose
    **Disable**.

    ### Re-enable

    On a **Disabled** version, choose **Enable**. Services resume when the key
    is available again. Official customer guidance is about 60 seconds.

    ### Destroy

    Destruction permanently deletes key material. Data encrypted only under
    that version becomes unreadable.

    <Warning>
      Do not destroy the primary version or any version that encrypted data
      you still need. Contact
      [support@askparable.com](mailto:support@askparable.com) before
      proceeding.
    </Warning>

    Schedule destruction from the version menu. GCP enforces a minimum
    24-hour wait. You can **Cancel destruction** during that window.

    ### Audit logs

    Every encrypt, decrypt, and key-management operation is in Google Cloud
    Audit Logs. You have read-only access to a log view that contains only
    your Workspace's KMS operations.

    <Steps>
      <Step title="Open Logs Explorer">
        In GCP Console, go to Logging → Logs Explorer.
      </Step>

      <Step title="Select your log view">
        Refine scope → Log view → `tenant-{your-slug}-kms-audit`.
      </Step>

      <Step title="Run the query">
        Results are scoped to your organization.
      </Step>
    </Steps>

    Common filters (replace the slug):

    ```text theme={null}
    resource.type="cloudkms_cryptokey"
    resource.labels.key_ring_id="tenant-{your-slug}-kms"
    protoPayload.methodName="Encrypt"
    ```

    Use `Decrypt` for decrypts, or
    `protoPayload.methodName=~"(DestroyCryptoKeyVersion|ScheduleCryptoKeyVersionDestruction|RestoreCryptoKeyVersion|UpdateCryptoKey)"`
    for key-management events.

    | Field                                            | Description      |
    | ------------------------------------------------ | ---------------- |
    | `protoPayload.methodName`                        | KMS operation    |
    | `protoPayload.authenticationInfo.principalEmail` | Who performed it |
    | `protoPayload.resourceName`                      | Key version path |
    | `timestamp`                                      | When             |

    KMS Data Access logs (encrypt/decrypt) are enabled on the Parable project.
    Key-management events are Admin Activity and are always on. For SIEM
    exports, contact [support@askparable.com](mailto:support@askparable.com).
  </Tab>

  <Tab title="Incident response">
    Disabling a key version makes GCP refuse encrypt/decrypt for that version
    within seconds. In-flight API requests that need decryption start failing.
    Background work stops retrying. Provider ingestion jobs fail. Encrypted
    data stays on disk; it is inaccessible until the key is available again.
    Dashboards show errors until you re-enable the key.

    Parable application service accounts can encrypt and decrypt. They cannot
    enable or disable keys. Infrastructure administrators will not re-enable
    your key without your written authorization.

    <Steps>
      <Step title="Sign in and open your keyring">
        Use your federated link or Google account. Open
        `tenant-{your-slug}-kms`.
      </Step>

      <Step title="Re-enable the version">
        Three-dot menu → **Enable**.
      </Step>

      <Step title="Wait for services to resume">
        Official customer guidance is about 60 seconds. Contact support if
        issues persist after 5 minutes.
      </Step>

      <Step title="Retry failed Provider syncs">
        Jobs that failed mid-run do not automatically retry. In Parable, open
        Providers and trigger a sync for any connection showing errors.
      </Step>
    </Steps>

    Before you disable a key in an incident: notify
    [support@askparable.com](mailto:support@askparable.com) or your account
    manager, note the time, disable the key, confirm errors appear, collect
    audit logs, then re-enable and retry Provider syncs when the incident is
    over.

    <AccordionGroup>
      <Accordion title="Can Parable read my data while the key is disabled?">
        No. GCP refuses decrypts, including Parable service accounts.
      </Accordion>

      <Accordion title="Does this affect other customers?">
        No. Each Workspace has its own keyring.
      </Accordion>

      <Accordion title="I scheduled destruction by mistake">
        You have at least 24 hours to click **Cancel destruction**. Contact
        [support@askparable.com](mailto:support@askparable.com).
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="FAQ">
    <AccordionGroup>
      <Accordion title="Do I need a Google account?">
        Not necessarily. Corporate SSO (Workforce Identity Federation) is
        recommended. Google Workspace organizations can use a Google account
        instead.
      </Accordion>

      <Accordion title="What happens to existing data when I rotate?">
        Existing objects stay readable under the old version. New writes use
        the new primary. Parable does not automatically re-encrypt old data.
      </Accordion>

      <Accordion title="Can Parable re-enable a key I disabled?">
        Application accounts have encrypt/decrypt only. Infrastructure
        administrators have broader KMS access for operations and will not
        re-enable your key without written authorization.
      </Accordion>

      <Accordion title="Can Parable read credentials while the key is enabled?">
        Parable decrypts credentials when processing ingestion on your behalf.
        Every decrypt is in Cloud Audit Logs.
      </Accordion>

      <Accordion title="What if I destroy a version?">
        Key material is gone. Data encrypted only by that version is
        unreadable. GCP waits at least 24 hours.
      </Accordion>

      <Accordion title="How often does automatic rotation run?">
        `main` rotates every 90 days. The asymmetric keys do not auto-rotate.
        You can rotate any key manually.
      </Accordion>

      <Accordion title="Does CMEK cover data in transit?">
        CMEK is encryption at rest. Transit uses TLS 1.2+. Provider
        credentials are also wrapped with RSA-OAEP-4096 on
        `credential-encryption` before they reach Parable servers.
      </Accordion>

      <Accordion title="Whose GCP project holds the keyring?">
        Parable's project. You have IAM on your keyring only.
      </Accordion>

      <Accordion title="How do I find my slug?">
        It is your Workspace slug. It appears in the keyring name
        `tenant-{your-slug}-kms`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>