Configure customer-managed encryption in Acrobat Sign

Use your organization’s AWS KMS key to protect supported Acrobat Sign agreement files at rest.

Adobe Acrobat Sign can use a customer-managed encryption key to protect supported agreement files at rest. This configuration, often called Bring Your Own Key (BYOK), gives eligible organizations more control over key management while preserving supported Acrobat Sign agreement workflows. Account administrators configure BYOK with an AWS Key Management Service (KMS) customer-managed key, AWS access credentials, and a cache time-to-live value.

Before you begin

• BYOK must be enabled for your account by Adobe before the controls are available.
• Use an AWS KMS customer-managed key. Azure Key Vault is not supported for this release.
• Create an AWS identity with the minimum required permissions to use the KMS key.
• Confirm that the AWS access key ID, AWS secret access key, and KMS key ARN are available before configuring the setting.
• Keep the customer-managed key and AWS credentials active. If Acrobat Sign cannot access the key, users may be unable to view, sign, download, or export encrypted agreements.
• Test BYOK in a controlled group of workflows before using it broadly.

Configuration

Availability

• Acrobat Sign Solutions: Supported
• Acrobat Sign for Government: Not supported.
• Acrobat Standard and Acrobat Pro: Not supported.

Configuration scope

• Customer encryption keys can be configured at the account level only.
• Default value: Disabled.

Impact on in-flight agreements

• Enabling BYOK applies only to agreements created after configuration.
• Pre-existing agreements continue to use Adobe-managed encryption.

To access this setting, go to Account Settings > Security Settings > Customer Managed Encryption

Controls

• Enable encryption with Customer Managed Key
  • When enabled, allows configuration of a customer-managed key.
  • When disabled, BYOK is not active for the account.
• AWS access key ID
  • Identifies the AWS principal used to access the KMS key.
• AWS secret access key
  • Authenticates access to AWS KMS.
• KMS key ARN
  • Specifies the customer-managed key used for encryption operations.
• TTL (Time to Live)
  • Defines how long changes to key availability take effect.
  • Values range from 5 to 60 minutes; the default value is 60 minutes.

How to configure Customer Managed Encryption (BYOK)

Step1 - Set up AWS KMS prerequisites.

Step 2 - Configure customer-managed encryption in Acrobat Sign.

You need to create an IAM policy, user group, and user in your AWS account that grant minimal permissions to use your CMK.

Step3 - Validate the configuration.

When you save the configuration, Acrobat Sign immediately validates your credentials by performing a test operation against your CMK. If validation fails, you will see one of these error messages:

• Access Denied: The IAM credentials do not have permission to use the specified KMS key. Verify the IAM policy is attached and scoped to the correct Key ARN.
• Key Not Found: The KMS Key ARN does not exist or belongs to a different AWS account. Double-check the Key ARN.
• Key Disabled: The CMK is currently disabled in AWS KMS. Enable the key in the AWS KMS Console before configuring BYOK.

Once saved successfully, all new agreements will be encrypted using your CMK.

Validation and common errors

During configuration, the system validates access to the specified key.

The following conditions may prevent successful configuration:

• The Access Key ID or Secret Access Key is invalid.
• The KMS Key ARN does not exist or is not accessible.
• The key is disabled or not active.

The configuration must complete successfully before the key can be used.

How the setting works

When BYOK is enabled, Acrobat Sign uses envelope encryption to protect supported agreement files at rest. The file content is encrypted with a document encryption key. That key is protected by customer-specific key material that is wrapped by the customer’s AWS KMS key.

For newly created supported agreements, Acrobat Sign records the account’s BYOK state and uses the customer-managed key path for supported agreement files. Existing agreements created before BYOK is enabled continue to use Adobe-managed encryption unless retroactive encryption is confirmed for the release.

BYOK applies to supported agreement files at rest. It does not change encryption in transit, email delivery behavior, recipient authentication, or normal agreement workflow processing.

Supported content for this release includes:

• Agreement PDFs.
• Templates.
• Thumbnails.
• Temporary files used during agreement workflows.

BYOK does not protect the following content in this release:

• Form field data.
• Search indices.
• Sensitive settings.
• Gov ID verification images.
• Data in transit.

To understand how this configuration affects system behavior, review the related process documentation: Understand BYOK behavior and data access 

Failure notifications

If Acrobat Sign cannot access the customer-managed key or required AWS credentials, agreement operations that require encrypted content may fail. When a BYOK key access failure occurs, Acrobat Sign sends an email notification to active account administrators.

Notifications may be triggered when:

• The customer managed key is disabled.
• The customer-managed key is pending deletion.
• The customer managed key is deleted.
• The customer managed key is unavailable.
• The AWS credentials are invalid, disabled, expired, or no longer have the required permissions.

The notification explains the failure type and recommended actions. Notifications continue at the configured reminder interval until access is restored.

Best practices

• Use a dedicated AWS KMS customer-managed key for Acrobat Sign BYOK.
• Grant only the minimum AWS KMS permissions required for Acrobat Sign to encrypt and decrypt supported agreement files.
• Keep the KMS key active for as long as the encrypted agreement content must remain accessible.
• Do not delete the KMS key unless your organization intends to permanently prevent access to content encrypted with that key.
• Rotate AWS credentials according to your organization’s security policy, then update the BYOK configuration before the old credentials expire.
• Use a shorter TTL when fast key revocation behavior is more important than minimizing AWS KMS calls.
• Test common workflows before broad rollout, especially workflows that use templates, integrations, high-volume sending, or automated downloads.
• Document your organization’s owner for AWS KMS key management so Acrobat Sign administrators know who to contact if key access fails.

Things to know

• BYOK protects supported agreement files at rest. It does not provide end-to-end encryption.
• Acrobat Sign still decrypts content as needed to process supported agreement workflows.
• BYOK is account-level only. Group-level configuration isn't supported.
• AWS KMS is the only supported customer key provider for this release.
• Azure Key Vault support should not be documented unless it has been confirmed for the release.
• Existing agreements are not included unless retroactive encryption is confirmed for the release.
• If the AWS KMS key or credentials become unavailable, users may be unable to access, sign, download, or export encrypted agreements.
• Account administrators receive failure notification emails when Acrobat Sign detects a customer-managed key access issue.
• CMK failure notification emails should not include AWS credentials, key material, or the KMS key ARN.
• Disable, rotate, revert, suspend, and destroy actions should not be documented as customer-facing actions until the scrum team confirms they are included in 17.1.2.