Skip to main content
The master key encrypts every personal-data record in the vault. It is generated automatically during initial setup and, unlike the open-source edition, is never exposed — not to users, not to administrators, and not through any API. Instead of handling the master key directly, you handle a wrapping key, which encrypts the master key. That indirection is what makes the rest of the key lifecycle practical:
  • The master key never leaves the vault. An attacker who obtains the encrypted master key cannot use it without the wrapping key.
  • Rotation is cheap. Rotating the wrapping key re-wraps the master key; it does not re-encrypt stored records, so the cost is independent of vault size.
  • Operational and recovery custody are separate. The wrapping key lives in your secret manager; recovery is held by Shamir key shares distributed among trusted parties.

​
Two independent wrappings

Databunker Pro stores the master key twice, wrapped by two different keys. This is the single most useful thing to understand about the key model, because it explains what rotation does and does not affect. Two consequences follow:
  • Rotation only replaces encryptedkey. Your five Shamir shares stay valid and never need reissuing or redistributing after a rotation, because recoverykey is untouched.
  • The shares remain permanently sensitive. Rotating the wrapping key does not invalidate previously issued shares — three of them still reconstruct the recovery path. Share custody is a standing obligation, not something rotation resets.

​
Recovery

If the wrapping key is lost while the instance is still running, you can recover by rotating: three Shamir shares let Databunker Pro mint a new wrapping key and re-wrap the master key, without the master key ever being exposed. See Wrapping key rotation.
This is not a general-purpose disaster-recovery mechanism. The vault cannot start without a wrapping key, and rotation is performed against a live instance. If the wrapping key is lost and the service has already stopped, contact support. If the wrapping key is lost and fewer than three shares remain, the data is unrecoverable — Databunker holds no copy of your keys and there is no escrow. See What is recoverable.