Customer-managed encryption keys (CMEK) (Enterprise tier)

Bring your own KMS key for encryption at rest. For organizations with strict data residency or key-rotation policies that require customer-controlled key material.