# Why is keeping the key in .env risky when encrypting sensitive financial data — what do KMS/Vault give you?

> Take the key out of .env, keep it in KMS or Vault and use envelope encryption; for national IDs and card data, prefer tokenization wherever you can.

- Asked: 2026-06-09
- Answered: 2026-06-12
- Asked by: Çağrı
- Tags: veritabani, guvenlik, altyapi
- Source: https://www.muhammetsafak.com.tr/en/just-ask/encrypting-sensitive-financial-data-at-rest-and-key-management/
- Language: en-US
- Author: Muhammet Şafak

---
**Question:** We have to keep users' national ID numbers or credit card tokens in the DB encrypted for KVKK/GDPR; an attacker who breaches the DB must not be able to read this data. When using symmetric encryption (AES-256) at the application layer, what are the risks of keeping the encryption key in a `.env` file on the app server?

How does integrating AWS KMS or HashiCorp Vault make the architecture secure?


Short answer: encrypting the field with AES-256 is right, but if the key sits in the `.env` *next to* the app, an attacker who reaches the server gets both the data and the key — the encryption buys you almost nothing. The whole point of KMS/Vault is to separate the key from the data.

The core of the problem: if the encrypted data and the key that opens it sit in the same place, the two are effectively one secret. Security comes from physically/permission-wise decoupling the key from the data.

1. **The key in `.env` is risk concentrated in one spot.** An attacker who takes the server (or causes a backup/`.env` leak) gets the encrypted DB and the key at the same time. The key also sits in plaintext in the file, it's hard to rotate, and there's no trace of who decrypted what and when.
2. **KMS/Vault never hand the raw key to the app.** The app calls KMS to encrypt/decrypt, or uses **envelope encryption**: the master key stays in KMS and encrypts a separate data key per record. So compromising the DB — or even the app server — doesn't hand over plaintext, because the master key was never there.
3. **You gain central rotation, audit, and IAM-scoped access.** KMS/Vault **rotate** the key centrally, write every decrypt to an **audit** log, and scope access via IAM/policy. "Which service decrypted which data, and when?" becomes answerable — critical under a compliance (KVKK/GDPR) audit.
4. **Prefer tokenization for national IDs/card data.** Where possible, don't hold the sensitive value at all: keep the real value in a vault/provider and pass only a **token** around the system. Then the vast majority of the system never sees the sensitive data — even if it leaks, what's taken is a meaningless token.

**Bottom line:** envelope encryption via KMS or Vault; the key never in `.env`, but somewhere that's rotated + audited. Tokenize wherever you can. One more note: full-disk encryption or `pgcrypto` alone isn't enough — a live DB connection still reads plaintext. The real protection comes from separating the key from the data and never giving the app the raw key.

## Related Reading

- [How do I set up secretless AWS access in CI/CD with OIDC and IAM roles?](https://www.muhammetsafak.com.tr/en/just-ask/secretless-ci-cd-with-aws-iam-roles-and-oidc/) — Just Ask
- [Disaster recovery: how do I design an active-passive scenario around RTO and RPO?](https://www.muhammetsafak.com.tr/en/just-ask/disaster-recovery-strategy-setting-rto-and-rpo/) — Just Ask
- [My non-root container can't write to the mounted storage directory—how do I fix the permissions?](https://www.muhammetsafak.com.tr/en/just-ask/my-non-root-container-cant-write-to-the-mounted-storage-directory/) — Just Ask