Per-organization encryption key: A dedicated encryption key assigned to a single customer organization (tenant) in a shared service, used to encrypt that organization's data separately from every other customer's.
Also known as: Per-tenant key, Tenant-specific key, Customer-specific encryption key
Key takeaways
- Multi-tenant services store many customers' data on shared infrastructure.
- A per-organization key encrypts each customer's data with its own key instead of one global key.
- It narrows the impact of a key compromise and adds a cryptographic boundary between customers.
- It is not the same as a customer-managed key: the provider can still manage it.
- C Chat uses AES-256 with a per-organization key for stored messages, plus TLS in transit.
Most cloud services are shared buildings. Thousands of companies keep their data on the same servers, separated by software rules. A per-organization encryption key adds a second wall: even at the storage level, each company’s data is locked with a key of its own.
A per-organization encryption key: a plain definition
In a multi-tenant service, every customer organization is a tenant. There are two broad ways to encrypt their stored data:
| Approach | How it works | Consequence |
|---|---|---|
| One shared key | All tenants’ data is encrypted with the same key | A single key exposure affects everyone |
| Per-organization keys | Each tenant’s data has its own key | An exposure is limited to one tenant; data is cryptographically separated |
The per-organization approach usually sits on top of other protections, such as disk-level encryption at rest, rather than replacing them.
How it works
When an organization is created, the service generates a dedicated key for it. Data belonging to that organization is encrypted with that key, typically using a symmetric cipher like AES-256. The key itself is protected by higher-level keys in a secure store, following standard key management patterns such as envelope encryption.
Because every read and write must use the right tenant’s key, the design also guards against a class of software bugs where one customer’s query could return another customer’s records: without the matching key, the data stays unreadable.
Per-organization keys are symmetric. They are unrelated to the key pairs of public-key cryptography, which secure connections and identities.
Why it matters for business messaging
A messaging service holds some of the most sensitive material a business has: incident reports, client details, staff instructions. Per-organization keys help in three practical ways:
- Containment. If one key were ever compromised, the impact would stop at one organization.
- Separation. Your team’s stored messages are not encrypted under the same key as anyone else’s.
- Clear answers for reviews. Security questionnaires increasingly ask whether customer data is encrypted with tenant-specific keys. The vendor security questionnaire includes that question.
How it relates to C Chat
C Chat encrypts each organization’s stored messages with AES-256 using that organization’s own key, and protects all connections with TLS. The details are in per-organization encryption keys explained and AES-256 encryption at rest, per organization, with the full flow in how C Chat encrypts your messages.
The per-organization key is part of C Chat’s auditable encryption model. It separates organizations from each other, while the access rules decide who can read inside an organization:
- Team owners and admins can audit and export their team’s group conversations.
- Direct messages between people are private.
- The platform accesses content only for moderation of reported messages or legal requirements, and that access is logged.
C Chat manages these keys; it does not offer customer-managed keys. For how this differs from device-only keys, read auditable encryption vs end-to-end encryption. For the connection layer, see TLS in C Chat.
Related terms and common misconceptions
- “Per-tenant key means only we can read our data.” Not necessarily; it depends on who manages the key.
- “Logical separation is the same thing.” Software rules separate tenants too, but a per-organization key adds a cryptographic layer underneath.
- “Every SaaS does this.” Practices vary. Ask the vendor directly rather than assuming.
Getting started
When your team’s messages move to C Chat, they are encrypted under your organization’s own key from the first message. Create a team in the web app at getcchat.com/c; it is free for now within the limits on the pricing page.
Frequently asked questions
What is a tenant in software?
A tenant is a customer, usually an organization, whose users and data live inside a shared service. Multi-tenant software serves many tenants from the same infrastructure while keeping their data logically separate.
Is a per-tenant key the same as bring your own key (BYOK)?
No. A per-tenant key means each customer has a separate key; the provider may still generate and manage it. BYOK means the customer generates or controls the key. C Chat uses per-organization keys and does not offer BYOK.
Do per-organization keys stop the provider from reading data?
Not by themselves. They separate customers from each other. Whether the provider can decrypt depends on who manages the keys. In C Chat, platform access to content is limited to moderation of reported messages or legal requirements and is logged.
What happens to my team's data if another organization is breached?
Per-organization keys are designed so that one organization's key does not decrypt another's data. That separation is one layer of defense; it works together with access controls and monitoring.