Why is keeping the key in .env risky when encrypting sensitive financial data — what do KMS/Vault give you?

Short answer: encrypting the field with AES-256 is right, but if the key sits in the .env next to the app, an attacker who reaches the server gets both the data and the key — the encryption buys you almost nothing. The whole point of KMS/Vault is to separate the key from the data.

Short answer

The core of the problem: if the encrypted data and the key that opens it sit in the same place, the two are effectively one secret. Security comes from physically/permission-wise decoupling the key from the data. The same “where does the secret live” question shows up in signature verification too; I covered the HMAC and idempotency side of webhooks in a separate record.

Why

1. The key in .env is risk concentrated in one spot. An attacker who takes the server (or causes a backup/.env leak) gets the encrypted DB and the key at the same time. The key also sits in plaintext in the file, it’s hard to rotate, and there’s no trace of who decrypted what and when.

2. KMS/Vault never hand the raw key to the app. So compromising the DB — or even the app server — doesn’t hand over plaintext, because the master key was never there.

3. “Which service decrypted which data, and when?” becomes answerable. That’s what a compliance (KVKK/GDPR) audit actually asks for; in the .env model there is no answer to that question.

What to do

1. Move to envelope encryption. Have the app call KMS to encrypt/decrypt: the master key stays in KMS and encrypts a separate data key per record. All the app holds is the encrypted data key.

2. Centralize rotation and auditing. KMS/Vault rotate the key centrally, write every decrypt to an audit log, and scope access via IAM/policy; turn all three on from day one.

3. Prefer tokenization for national IDs/card data. Where possible, don’t hold the sensitive value at all: keep the real value in a vault/provider and pass only a token around the system. Then the vast majority of the system never sees the sensitive data — even if it leaks, what’s taken is a meaningless token.

Bottom line: envelope encryption via KMS or Vault; the key never in .env, but somewhere that’s rotated + audited. Tokenize wherever you can. One more note: full-disk encryption or pgcrypto alone isn’t enough — a live DB connection still reads plaintext. The real protection comes from separating the key from the data and never giving the app the raw key.