> Source: https://complior.se/en/fallstudie/

Case study / Key control Scrive 

# Cloud in AWS. 
The root keys with Complior. 

For a service built on digital trust, control over information is essential. Scrive combines AWS with external key management from Complior. 

Business: Electronic signing 

Cloud platform: Amazon Web Services 

Solution in the case study: KMS · HSM · AWS XKS 
[See how the components fit together ↓](https://complior.se/en/fallstudie/#sc-architecture) 

The core A separate location for key control. 

Cloud platform and external root keys with different providers. 

## Stay in the cloud. 
Strengthen control. 

Scrive develops electronic signing services. Complior's case study describes the need to use AWS while addressing increasing data protection requirements. 

The solution combines KMS and HSM in Swedish data centres with AWS External Key Store, XKS. Scrive also describes in its own Sovereign Keystore service how the external root keys are held by Complior, outside AWS. 

Generated concept illustration. Does not show the customer's actual environment. 

The solution in principle 

## Two environments. 
A clear boundary. 

The information resides in the cloud environment. External key management gives root keys a separate location at Complior. 

Cloud environment / AWS 

### Scrive's service 

Application and encrypted information. 

AWS XKS Request for 
key operations 

Key environment / Complior 

### KMS & HSM 

External root keys with hardware-based protection. 

Simplified schematic with conceptual illustrations. The connection represents key operations, not the transfer of documents to Complior. The diagram does not depict Scrive's complete architecture. 

What this approach adds 

## Control where 
it makes a difference. 

Scrive's own description highlights external key storage, visibility into key operations and the ability to restrict use. 

- 01 / SEPARATION 

### Keys outside AWS. 

The root keys are held by a separate provider. The cloud platform and external key environment have distinct roles. 

- 02 / VISIBILITY 

### Follow key operations. 

Scrive describes API calls to the external key management service as an opportunity for monitoring and control. 

- 03 / CONTROL 

### Limit usage. 

The external key service makes it possible to control key operations. Its effect in a particular service depends on the integration and any caching. 

### Part of data protection. 

External key management needs to be designed alongside access, availability and recovery. It is a technical control, not a general guarantee of legal compliance. 

## Read more at the source. 

Adapted presentation of Complior's case study from 25 March 2024, supplemented by Scrive's own description. 

- The customer story was published by Complior on 25 March 2024. 

- [Scrive Sovereign Keystore · English ↗](https://www.scrive.com/resources/trust-centre/scrive-sovereign-keystore) 

- [AWS on External Key Store · English ↗](https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html) 

Apply the principle to your environment 

## Where should your 
key control reside? 

Start with your services and requirements. We help you assess integrations and responsibilities. 

[Discuss external key control →](https://complior.se/en/contact/) [Explore KMS & HSM →](https://complior.se/en/key-management/)