>
    Strata Copilot
    Managing Customer Encryption Keys
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. Administration
    4. Defend: Create and Configure API Security Profile
    5. Managing Customer Encryption Keys
    Download PDF
    Prisma AIRS

    Managing Customer Encryption Keys

    Table of Contents

    Managing Customer Encryption Keys

    Learn about managing your encryption keys in Prisma AIRS.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Runtime: API security
    Prisma AIRS encrypts all of your AI security scan data — including prompts, model responses, and tool calls — before storing it. This feature gives you direct control over that encryption key. With this functionality you can:
    • Rotate - this creates a new key version and promotes it to primary; future uploads use the new version, and existing data remains accessible via the old version.
    • Disable (per key version) - this disables a specific key version by number; data encrypted with that version becomes inaccessible within approximately 1 minute.
    • Enable (per key version) - this re-enables a previously disabled key version, restoring read access to data encrypted with it.
    You can do this all without opening a support ticket:
    • What gets encrypted: All raw scan content associated with your tenant — prompts, model responses, and tool call data stored by Prisma AIRS.
    • How keys work: Your data is protected by an encryption key unique to your tenant. When you view a security violation in Strata Cloud Manager, that key is used to decrypt your data for display. If the key is disabled, violation data becomes inaccessible.
    • Automatic rotation: Your encryption key rotates automatically every 90 days. The operations in this guide let you act outside that schedule when your security posture requires it.
    • Who can do this: You need the appropriate role in Strata Cloud Manager. Contact your administrator if you don't see the Data Encryption settings panel.
    Encryption key management is available in all regions.
    Frequently Asked Questions
    Does rotating my key affect my existing scan data?
    No. Your existing scan data stays fully accessible after a rotation. Only new data is protected by the new key version.
    What happens to new scans when I disable my primary key?
    Disabling the primary key version does not automatically create a new key; new scans will fail until you either re-enable that version or rotate to create a new primary key.
    How quickly does disabling take effect?
    Within approximately 1 minute of disabling the key version, the data encrypted with that specific key version becomes inaccessible.
    Can I undo disabling a key version?
    Yes. Use the Enable a disabled key version action to re-enable your key and regain access to your data.
    My key was disabled and I can't see violation details. What should I do?
    Go to Configurations › Data Encryption and use the Enable Key action on the relevant Key Version. If you did not intentionally disable your key, contact your security team before restoring.
    How do I know when my key will next rotate automatically?
    The Data Encryption panel shows the Next Rotation Date.
    Do I need to do anything for automatic rotations?
    No. Automatic rotations happen in the background every 90 days without any action required on your part.
    Who can see and manage encryption keys?
    Your Strata Cloud Manager administrator controls who has permission to rotate, disable, or enable keys. Viewing key health is available to all roles. Rotating the key and disabling or enabling a key version require an elevated permission.
    To locate your encryption keys:
    1. Log in to Strata Cloud Manager.
    2. Navigate to Configurations in the left sidebar.
    3. Select Data Encryption.
      The Encryption panel shows the current health of your key — when it was created, when it was last rotated, and when the next automatic rotation is scheduled.
      Understanding Key Status
      StatusWhat it means
      EnabledYour key is working normally. Data is accessible and new scans are being protected.
      DisabledYour key has been disabled. Existing scan data is inaccessible until the key is enabled.
      Important consideration
      Specific key versions are disabled individually; this action does not result in a universal lockdown of your total scan history. You can disable one version while other versions remain enabled. You can also disable all versions by using disable for each. This distinction is important in such scenarios where you need to selectively lockdown a specific version for forensic purposes, or for GDPR erasure.
      Rotating Your Key
      Rotating your key creates a new encryption key version and makes it primary. Your existing scan data stays fully accessible — it is not affected by the rotation. New scan data will be protected by the new key going forward.
      When to rotate:
      • Your internal security policy requires periodic key rotation
      • You suspect your environment may have been compromised
      • You want to align with a compliance audit cycle
      To rotate your key:
      1. Go to Configuration › Data Encryption.
      2. Click Rotate Key.
      3. Confirm the action when prompted.
      The new key becomes active immediately. Existing data remains accessible and is not re-encrypted. There is no downtime.
      Disabling Your Key
      Disabling your key will make your scan data inaccessible within approximately 1 minute. Violation details in Strata Cloud Manager will no longer display for affected data.
      This is a high severity action. Use caution before disabling your key.
      Within about a minute of disabling a key, all scan data protected by that key becomes unreadable. Disabling a non-primary key version does not stop new scans from being recorded.
      This action can be undone using the Enable Key action.
      When to disable:
      • You need to immediately cut off access to scan data due to a security incident.
      • Legal or compliance operations require an immediate data lockdown.
      • You are offboarding and need to ensure data is permanently inaccessible.
      To disable your key:
      1. Go to Configuration › Data Encryption.
      2. Navigate to the relevant Key Version, Click Disable Key.
      3. Read the confirmation carefully — it explains exactly what will become inaccessible.
      4. Type the confirmation phrase and click Confirm Disabling.
      There is approximately a 1 minute delay between confirming the disable key version action and your data becoming inaccessible.
      Enabling Your Key
      If you have previously disabled your key — whether intentionally or in error — you can re-enable it to regain access to your scan data.
      To restore your key:
      1. Go to Configuration › Data Encryption.
      2. Navigate to the relevant Key Version, Click Enable Key.
      3. Confirm the action when prompted.
      Access to your previously inaccessible data is restored shortly after you confirm.

    © 2026 Palo Alto Networks, Inc. All rights reserved.