Manage encryption

Using Creative Cloud or Document Cloud for enterprise, end users can store files safely and securely. Users can also share files and collaborate with others. Files are accessible to users via the Creative Cloud website, Creative Cloud desktop app, and Creative Cloud mobile app. Storage is available with Creative Cloud or Document Cloud for enterprise only if it is a part of your organization's agreement with Adobe.

While all data on Creative Cloud and Document Cloud is encrypted, for extra layers of control and security, you can choose to have Adobe generate a dedicated encryption key for some or all the directories in your organization. Contents are then encrypted using the dedicated encryption key. If necessary, you can revoke the encryption key from the Admin Console.

Dedicated encryption keys are available only with the Creative Cloud or Document Cloud for enterprise shared services plans that include storage and services.

Before enabling dedicated encryption keys for your directories, see Adobe Creative Cloud for enterprise security overview or Adobe Document Cloud security.

To upgrade your plan to include storage and services, contact your Adobe Account Manager.

You can use dedicated encryption keys on a directory-by-directory basis, for the directories in your organization.

Make note of the following when working with encryption keys:

• Ensure that you have claimed and activated your domains to enable dedicated encryption keys for the directories that contain these domains.
  
• Once you enable a dedicated encryption key, you cannot revert to using standard encryption keys.
• You can revoke a dedicated encryption key, if necessary. If you revoke the encryption key, your users can no longer access content that has been encrypted using the encryption key. For example, if you suspect a data breach, you can immediately revoke the dedicated encryption key from the Admin Console.
• To restore access to content whose encryption key has been revoked, re-enable the encryption key from the Admin Console.

The following data is not encrypted using the dedicated encryption key and is therefore not affected if the key is revoked:

• Data of members of an organization with an Adobe ID account (unless the user is collaborating on content when Enterprise ID or Federated ID users initiated the collaboration)
• Metadata (file name, collection name, font use, MIME type, and other attributes necessary to browse a collection)
• Videos published by Premiere Clip and Adobe Spark Video
• Lightroom photos
  
• Colors that are stored by the Adobe Color service
• All data that is managed by the Behance and Adobe Fonts services
• All data managed by the Marketing Cloud
• Saved application preferences
• Information about the account holder such as name, email, licenses, and other basic user account information

To use a dedicated encryption key for your directory, follow the below process:

Also, a message is displayed if, for any reason, the enabling of the encryption key fails or the key is enabled but asset encryption has failed.

If you revoke a dedicated encryption key, data encrypted with the encryption key is no longer accessible to users.

To revoke the dedicated encryption key for a directory, do the following: