Recovery Keys

Managing BitLocker and FileVault recovery keys stored on your server.

Overview

When the Encryption Guard enables BitLocker (Windows) or FileVault (macOS), the recovery key is encrypted and sent to your central server via POST /api/v1/recovery-key.

This means recovery keys are stored on your infrastructure — not Microsoft's or Apple's cloud.

Viewing Recovery Keys

  1. Navigate to Devices → select a device
  2. Click Recovery Keys
  3. Authenticate to view the key (requires tenant_admin role)

Key Rotation

When a device rotates its encryption recovery key:

  • The new key is uploaded and marked as is_current = true
  • Previous keys are retained but marked as non-current
  • The full key history is available for audit purposes

Access Logging

Every time a recovery key is viewed, an entry is recorded in the recovery_key_access_log with:

  • Who accessed the key
  • When it was accessed
  • Which device's key was viewed

This provides a complete audit trail for compliance requirements.

Security

  • Recovery keys are AES-encrypted before transmission
  • Only tenant_admin and super_admin roles can view recovery keys
  • Keys are never exposed in API responses unless explicitly requested