Hold Your Own Key
HYOK goes further than BYOK: the encryption keys never leave the customer's own systems, so the cloud provider can never decrypt the data on its own. Decryption requires calling back to hardware or key servers the customer controls. It offers the strongest protection against provider compromise or legal compulsion, but it adds latency and can break cloud features that need to read the data.