A cryptographic pattern where data is encrypted with a unique DEK, which is itself encrypted by a master key or KEK.
Envelope Encryption encrypts each piece of data with a unique Data Encryption Key (DEK), which is then wrapped by a Key Encryption Key (KEK).
Envelope encryption protects data with a data key and protects that key separately. Passtru uses server-side envelope encryption and controlled key access for stored evidence. Encryption at rest does not mean the server cannot process authorized evidence.
Benefits: single DEK compromise exposes only one piece of data; key rotation re-wraps DEKs without re-encrypting data.
