Per-tenant key envelopes
Why every Threxen tenant runs inside its own cryptographic envelope — and what that guarantee actually buys your auditor.
Every customer — and every business unit, subsidiary, or jurisdiction inside it — runs inside its own key envelope. The envelope is the unit of isolation. Threxen operators cannot read tenant data, and a compromise in one envelope cannot reach another, because there is no shared multi-tenant store and no parallel “ops” database that drifts out of sync.
The mechanism is a single table, keyEnvelopes, that tracks status (ISOLATED, ROTATING, COMPROMISED, PENDING), key_version, last rotation, and a hash chain tying every envelope to the audit_EVENTS log it serves. Rotation, escrow, and HSM-backed bring-your-own-key are first-class — rotation happens without rewriting history, and BYOK is exercised end-to-end before a tenant flips to production. Sector-pinned storage follows from the envelope: PHI stays in HIPAA-only data planes, card data in PCI-isolated CDE views, EU operational data in EU-only jurisdictions.
The practical upshot, for your auditor, is straightforward: the envelope is the boundary. If you can read the row in keyEnvelopes, the data behind it is yours; if you cannot, it is not. There is no soft "access via partnership" back door, no pull-the-data-into-a-warehouse escape hatch, and no override flag operators can flip at 02:00 because a customer compressed a deadline.