Customer-managed keys: Google Cloud KMS
This page sets up a Cloud KMS key to protect your organization’s stored Syntic content. How customer-managed keys work, and what they cover, is on Customer-managed keys.
Before you start
- A Google Cloud project for security resources, with the Cloud KMS API enabled.
- Permission to create keys and change IAM policy on them (for example the Cloud KMS Admin role).
- An Owner of the Syntic organization to register the key.
Create a key ring and key
Pick a location close to your data region; a key in europe-west3 for EU data, for example.
gcloud kms keyrings create syntic --location=europe-west3 --project=acme-sec
gcloud kms keys create content \
--keyring=syntic --location=europe-west3 --project=acme-sec \
--purpose=encryption \
--rotation-period=90d \
--next-rotation-time=$(date -u -d '+90 days' +%Y-%m-%dT%H:%M:%SZ)Automatic rotation is fine: Syntic records which key version wrapped each data key and uses it to unwrap.
Find Syntic’s service account
In the Console, open Settings → Security → Encryption, select Use my own key and choose Google Cloud. The page shows the Google service account Syntic uses for your organization.
Grant encrypt and decrypt on the key only
gcloud kms keys add-iam-policy-binding content \
--keyring=syntic --location=europe-west3 --project=acme-sec \
--member="serviceAccount:<service account shown in the Console>" \
--role="roles/cloudkms.cryptoKeyEncrypterDecrypter"Bind the role at key level (not ring- or project-wide), so Syntic can use this key and nothing else.
Register the key
Paste the key’s resource name into the Console and select Verify, or use the Admin API:
curl -sS -X PUT https://app.syntic.ai/v1/organizations/encryption_key \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "Content-Type: application/json" \
-H "syntic-beta: admin-2026-11-01" \
-d '{"provider": "gcp",
"key_ref": "projects/acme-sec/locations/europe-west3/keyRings/syntic/cryptoKeys/content",
"reencrypt_existing": true}'Operating the key
- Audit: Cloud Audit Logs record every encrypt and decrypt call Syntic makes. Data-access logs for Cloud KMS must be turned on to see them.
- Disabling access: disabling the key version or removing the IAM binding makes protected content unreadable within about 5 minutes (the in-memory cache lifetime). The key’s status becomes
revoked; see Get the encryption key. - Destroying versions: a destroyed key version cannot be recovered, and neither can the content it protected. Cloud KMS schedules destruction with a delay; use that window to change your mind.
Keep the key in a project with tight access. Anyone who can change its IAM policy can cut Syntic off from your data, or grant others the ability to decrypt it.