---
title: Understanding security measures when using Key Manager
description: Learn best practices for secure key storage, DEK usage, and cost-efficient encryption with Scaleway Key Manager to protect your data effectively.
tags: key-manager security-measures security encryption decryption
dates:
  validation: 2025-08-11
  posted: 2025-02-06
---

## Key storage

We strongly advise that you **never store [data encryption keys (DEKs)](/key-manager/concepts/#data-encryption-key-dek) in plaintext**.

**Storing DEKs in plaintext poses a significant security risk** and defeats the purpose of using Key Manager or any key management service in the first place.

You should always use your [key encryption key (KEK)](/key-manager/concepts/#key-encryption-key-kek) [created via Key Manager](/key-manager/how-to/create-km-key/) to encrypt and decrypt your DEKs.

## Key deletion

Always **delete the plaintext version of your DEKs** after use. The key you should use to encrypt your DEKs securely is your KEK.

This practice is crucial for **maintaining the security of the encrypted data** by minimizing the time during which the plaintext DEKs are exposed and vulnerable to unauthorized access.

## Use DEKs only once

For **each piece of plaintext data that you want to encrypt**, you should generate a new, **unique DEK**, through Scaleway's Key Manager.

Using a unique DEK for each piece of plaintext ensures that even if one DEK is compromised, it does not affect the security of other encrypted data.

## Use Key Manager to encrypt your DEKs only

While it is technically possible to encrypt and decrypt data directly in Key Manager (with a size limitation of up to 64 KB), **we do not advise that you use Key Manager this way**.

Instead of using Key Manager for data encryption and decryption, you should use a data encryption key (DEK).

This is recommended for two main reasons:

- Performance: Encrypting and decrypting data directly with Key Manager can be less efficient compared to using a DEK, especially for larger volumes of data.

- Economic: **Scaleway charges for each operation involving KEKs**. Using a DEK minimizes the number of operations you need to perform with the KEK, reducing costs.