> For the complete documentation index, see [llms.txt](https://docs.tessell.com/tessell/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tessell.com/tessell/governance/security-doc.md).
# Security
The Security app, part of the Governance app family, allows you to manage encryption keys and password policies for your Tessell environment. Encryption keys protect data at rest for your database services. Password policies are organization-level settings, typically managed by account administrators to define the minimum password strength and password expiry period for all users. Users are required to reset their passwords when they expire.
The Security app has two tabs:
* **Encryption Keys** — Create and register encryption keys across cloud subscriptions and regions.
* **Password Policies** — Configure password restrictions and expiry rules for users.
***
## Key concepts
### Encryption keys
Tessell encrypts all database data at rest using encryption keys. You can use one of two key types:
* **Tessell Managed** — Tessell creates and manages the encryption key on your behalf within your registered cloud subscription. This is the default option and requires no additional configuration on your cloud account.
> **Note**: This is only applicable to Tessell Managed or Virtual Private Tessell (VPT) subscriptions.
* **Customer Managed (BYOK)** — You bring your own encryption key from your cloud account (AWS KMS or Azure Key Vault) and register it with Tessell. This gives you full control over the key lifecycle, including rotation and deletion policies.
Encryption keys are scoped to a cloud subscription and made available across one or more regions within that subscription. When you provision a database service, you select an encryption key from the keys available in the subscription and region you are deploying to.
### Password policies
Password policies apply organization-wide to all Tessell portal users. They define the minimum requirements for password complexity, password expiry period, and control how many failed login attempts are allowed before a user is locked out.
***
## Prerequisites
Before you create or register an encryption key, ensure the following:
* You have registered a cloud subscription in the [Subscriptions](/tessell/governance/subscriptions.md) app under the Governance app family.
* For customer-managed keys on AWS: the KMS key must exist in your AWS account, must be of type Symmetric with key usage set to Encrypt & Decrypt, and must have the `ALLOW_IMPORT_TO_TESSELL: true` tag applied. The key must also have cross-region replication enabled.
* For customer-managed keys on Azure: the key must exist in the Key Vault registered with your Tessell subscription.
***
## Security dashboard
To access the Security app, select **Security** under the Governance app family in the left navigation bar. Security app is accessible only to account owners and users whose personas grant them access to this app.
The dashboard has two tabs: **Encryption Keys** and **Password Policies**.
***
## Encryption keys
The **Encryption Keys** tab lists all encryption keys registered with Tessell across your subscriptions.
**Filters**
You can filter the encryption keys list using the following fields:
* **Search** — Specify a key name to search for a specific encryption key. The list filters automatically as you type.
* **Maturity** — Select a maturity status from the dropdown list. Available options are All, Draft, Published, or Unpublished.
* **Owner** — Select a username to view keys owned by a specific user.
* **Subscriptions** — Select a subscription to view keys associated with a specific subscription.
* **Clear** — Select this to clear all selected filters and return to the default view.
**Encryption keys table**
The encryption keys table displays the following columns:
* **Name** — The name of the encryption key registered with Tessell.
* **Cloud** — The cloud provider the key is associated with.
* **Regions** — The number of regions in which the key is available. Select the number to view the list of regions.
* **Maturity** — The maturity status of the key: Draft, Published, or Unpublished.
* **Status** — The current status of the key: Available or Unavailable.
* **Owner** — The owner of the encryption key.
* **Key Type** — Whether the key is Tessell Managed or Customer Managed.
* **Ellipsis icon** — Select the ellipsis icon to access the following options:
* **Add Co-owners** — Share the encryption key with other users by granting them the co-owner role.\\
> **Note**: Adding co-owner role grants other users permission to manage the key's lifecycle within Tessell, including deleting the key, updating its maturity status, and so on.
* **Remove Co-owners** — Remove co-owner access from a user.
**Fig 1: Security dashboard**
***
### Create an encryption key
Use this option to create an encryption key. Tessell creates and manages the key on your behalf in the selected cloud subscription.
#### Create a Tessell Managed key
Creating a Tessell-managed key is only supported for VPT subscriptions or subscriptions where the customer has granted Tessell the necessary permissions to create and manage the key.
1. Select **+ Create** in the top-right corner of the Encryption Keys tab.\
The **Create Key** page opens.
2. From the **Tessell Subscription** dropdown list, select the subscription.
3. In the **Name** field, specify a name for the encryption key.
4. Optionally, add a description in the **Description** field.
5. In the **Cloud** dropdown list, cloud provider is displayed based on the subscription selected.
6. The **Use Tessell generated secret key** check box is selected by default. Keep this selected to allow Tessell to generate and manage the key material.
7. Select **Create**.
**Fig 2: Create key – AWS / Azure**
