Setting up advanced encryption (ADPP add-on)

<body>
<p id="docs-hc-snippet" style="display: none;">Advanced encryption allows your company to encrypt your Service Data using your own enterprise Key Management Service (KMS), ensuring data stored in Zendesk can’t be read in plaintext by an external party and is decrypted just in time to enable Zendesk services. This feature strengthens your security posture and helps you comply with data protection and privacy obligations. SeeAbout advanced encryptionto learn more.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_adpp">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Advanced Data Privacy and Protection (ADPP)</td>
</tr>
</tbody>
</table>
</div>

</div>

<div class="body">

<div class="note fastpath" id="ac_advanced_encryption_setup__note_og3_b2r_hcc">
<span class="fastpathtitle">Location: </span> <span class="ph">Admin Center &gt; Account &gt; Security &gt; Advanced encryption</span>
</div>
<p class="p">Advanced encryption allows your company to encrypt your Service Data using your own
enterprise Key Management Service (KMS), ensuring data stored in Zendesk can’t be read
in plaintext by an external party and is decrypted just in time to enable Zendesk
services. This feature strengthens your security posture and helps you comply with data
protection and privacy obligations. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5043582015898" target="_blank">About advanced encryption</a> to learn more.</p>
<p class="p">This article helps you set up advanced encryption in your Zendesk account:</p>
<ul class="ul" id="ac_advanced_encryption_setup__ul_f4k_znp_jcc">
<li class="li"><a class="xref" href="#topic_w45_gvk_12c">Supported Key Management Services</a></li>
<li class="li"><a class="xref" href="#topic_l1b_f4p_jcc">Step 1: Request access to advanced encryption</a></li>
<li class="li"><a class="xref" href="#topic_a1p_h4p_jcc">Step 2: Create a Secure Configuration Portal account</a></li>
<li class="li"><a class="xref" href="#topic_nnm_j4p_jcc">Step 3: Configure KMS access keys</a></li>
<li class="li"><a class="xref" href="#topic_udb_l4p_jcc">Step 4: Activate advanced encryption</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_w45_gvk_12c">
<h2 class="title topictitle2" id="ariaid-title2">Supported Key Management Services</h2>
<div class="body">
<p class="p">Before you begin, you must have a KMS in place that is supported by Zendesk for
advanced encryption:</p>
<ul class="ul" id="topic_w45_gvk_12c__ul_pdf_nbl_12c">
<li class="li"><a class="xref" href="https://aws.amazon.com/kms/" target="_blank">AWS
KMS</a></li>
<li class="li"><a class="xref" href="https://azure.microsoft.com/en-us/products/key-vault" target="_blank">Azure Key Vault</a></li>
<li class="li"><a class="xref" href="https://cloud.google.com/security-key-management" target="_blank">Google Cloud KMS</a></li>
<li class="li"><a class="xref" href="https://cpl.thalesgroup.com/encryption/ciphertrust-manager" target="_blank">Thales CipherTrust Manager</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_l1b_f4p_jcc">
<h2 class="title topictitle2" id="ariaid-title3">Step 1: Request access to advanced encryption</h2>
<div class="body">
<p class="p">Start the setup process by requesting access to advanced encryption. Ensure the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6561144266906" target="_blank">ADPP add-on</a> is turned on in your account.</p>
<p class="p"><strong class="ph b">To request access to advanced encryption</strong></p>
<ol class="ol" id="topic_l1b_f4p_jcc__ol_hld_psp_jcc">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Advanced encryption</strong>.</span></li>
<li class="li">Click <strong class="ph b">Request access</strong> in the lower right.<p class="p"><img class="image img-screenshot" id="topic_l1b_f4p_jcc__image_st3_cnx_dvb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_request_access_new.png" width="800"></p>
<p class="p">After a few moments, you'll receive an invitation email.
</p>
<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_invitation_email_new.png" width="600"></p>
</li>
<li class="li">Click <strong class="ph b">Get Started</strong> in the email message.<p class="p">A page opens, prompting you to
create an account in the Secure Configuration Portal. Continue to <a class="xref" href="#topic_a1p_h4p_jcc">Step 2</a>. </p>
<p class="p">You have
seven days from receiving the invitation email before it expires. Click
<strong class="ph b">Resend email request</strong> to receive a new email if the previous
invitation has expired.</p>
<p class="p"><img class="image img-screenshot" id="topic_l1b_f4p_jcc__image_ew1_5lp_c2c" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_resend_email_request.png" width="400"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_a1p_h4p_jcc">
<h2 class="title topictitle2" id="ariaid-title4">Step 2: Create a Secure Configuration Portal account</h2>
<div class="body">
<p class="p">Create an account in the Secure Configuration Portal to manage your KMS
configurations.</p>
<p class="p"><strong class="ph b">To create a Secure Configuration Portal account</strong></p>
<ol class="ol" id="topic_a1p_h4p_jcc__ol_a3s_nwp_jcc">
<li class="li">After clicking <strong class="ph b">Get Started</strong> in the invitation email, an account creation
page appears. Create your account credentials, then click <strong class="ph b">Create
account</strong>.<p class="p">If you manage multiple accounts, including sandboxes, choose
a descriptive company name and domain to uniquely identify the account.</p>
<div class="p">
<ul class="ul" id="topic_a1p_h4p_jcc__ul_lqv_xql_kcc">
<li class="li">Enter your name, email address, and create a password for your
account.</li>
<li class="li">For Company Name, enter your Zendesk <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883411354#topic_swn_h2f_3xb" target="_blank">subdomain</a>.</li>
<li class="li">For Company Domain, enter
<code class="ph codeph"><em class="ph i">yoursubdomain</em>.zendesk.com</code>, where
<em class="ph i">yoursubdomain</em> is your Zendesk subdomain. If you're
testing on a sandbox first,add the sandbox subdomain.</li>
</ul>
</div>
<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_create_config.png" width="300"></p>
</li>
<li class="li">Your account recovery token displays. Click <strong class="ph b">Download</strong> to download the
token. It's important to store the token in a safe location, such as a password
manager. If you forget your password, you'll be prompted to use this
token.<p class="p"><img class="image img-screenshot" id="topic_a1p_h4p_jcc__image_pqd_tmp_c2c" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_account_recovery_token_new.png" width="400"></p>
</li>
<li class="li">Click <strong class="ph b">Confirm and close</strong>.<p class="p">A login page appears.</p>
</li>
<li class="li">Enter the email and password you just created, then click <strong class="ph b">Login</strong>.<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_login.png" width="300"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested1" id="topic_nnm_j4p_jcc">
<h2 class="title topictitle2" id="ariaid-title5">Step 3: Configure KMS access keys</h2>
<div class="body">
<div class="p">Next, you'll configure the KMS access keys. This is a 3-step process:<ol class="ol" id="topic_nnm_j4p_jcc__ol_hwn_cw4_22c">
<li class="li"><a class="xref" href="#topic_vjz_hxp_jcc">Create encryption keys in your
KMS</a></li>
<li class="li"><a class="xref" href="#topic_hny_3xp_jcc">Add your KMS configuration in
the Secure Configuration Portal</a></li>
<li class="li"><a class="xref" href="#topic_qyq_jxp_jcc">Create the KMS configuration
assignment</a></li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="topic_vjz_hxp_jcc">
<h3 class="title topictitle3" id="ariaid-title6">Create encryption keys in your KMS</h3>
<div class="body">
<p class="p">In your <a class="xref" href="#topic_w45_gvk_12c">Zendesk-supported
KMS</a>, create your encryption keys by following the KMS-specific
instructions.</p>
<p class="p">After creating encryption keys in your KMS, make a backup copy. It's important to
back up your encryption keys for business continuity and disaster recovery.
Zendesk won't have access to your KMS and can't assist with disaster recovery.
See the documentation for your KMS for instructions.</p>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="topic_hny_3xp_jcc">
<h3 class="title topictitle3" id="ariaid-title7">Add your KMS configuration in the Secure Configuration Portal</h3>
<div class="body">
<p class="p">Next, add your KMS credentials in the Secure Configuration Portal and configure
which key to use when encrypting your data.</p>
<p class="p"><strong class="ph b">To add your KMS configuration</strong></p>
<ol class="ol" id="topic_hny_3xp_jcc__ol_prs_qxp_jcc">
<li class="li">Go to <a class="xref" href="https://advanced-encryption.zendesk.com" target="_blank">https://advanced-encryption.zendesk.com</a> and log in to the Secure Configuration Portal. </li>
<li class="li">On the Secure Configuration Portal dashboard, click the icon for your KMS
under Add Config.<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_add_config.png" width="200"></p>
</li>
<li class="li">Add your access credentials and configure the key to use when encrypting
your data. The steps to do this depend on which KMS you are using. Click
<strong class="ph b">NEED HELP?</strong> to open a step-by-step guide for your KMS. <p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_create_Thales_config.png" width="500"></p>
</li>
<li class="li">After you finish adding your access credentials, click <strong class="ph b">Encrypt and
save</strong>.</li>
<li class="li">Click <strong class="ph b">Yes</strong> to set the new configuration as the primary
configuration.</li>
<li class="li">The configuration is displayed on the KMS Configurations page. Note the
<strong class="ph b">KMS Config ID</strong>. You’ll need this ID for the next step.<p class="p"><img class="image img-screenshot" id="topic_hny_3xp_jcc__image_m2w_nrp_c2c" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_key_leasing_enabled_default_2.png" width="300"></p>
<div class="p">
<div class="note note" id="topic_hny_3xp_jcc__note_hw1_vpf_d2c">
<span class="notetitle">Note:</span> Key leasing is turned on by default, which
reduces the cost of using the KMS and request latency. Key leasing
is an extra layer of key wrapping so the advanced encryption service
doesn’t need to make a request to your KMS on every key wrap and
unwrap operation. Instead, it leases a key, wrapping it using your
KMS, and it uses that key for a period of time to wrap and unwrap
the keys that encrypt application data. The key is checked for
validity with the KMS every 10 minutes. If the key is no longer
valid, it’s destroyed.</div>
</div>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested2" id="topic_qyq_jxp_jcc">
<h3 class="title topictitle3" id="ariaid-title8">Create the KMS configuration assignment</h3>
<div class="body">
<p class="p">Create the KMS configuration assignment, which allows Zendesk to use the KMS
configuration to protect your data. If you added multiple KMS configurations,
you must create an assignment for each.</p>
<p class="p"><strong class="ph b">To create the KMS configuration assignment</strong></p>
<ol class="ol" id="topic_qyq_jxp_jcc__ol_cvm_vzp_jcc">
<li class="li">In the Secure Configuration Portal, click <strong class="ph b">KMS Config Assignments</strong> in
the left pane.</li>
<li class="li">Click the plus icon (<img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_plus_icon.png" width="15">) to add a config assignment.
<p class="p"><img class="image img-screenshot" id="topic_qyq_jxp_jcc__image_jk3_f1q_jcc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_add_config_assign.png" width="250"></p>
</li>
<li class="li">Complete the following fields on the Assign KMS Configuration page:<ul class="ul" id="topic_qyq_jxp_jcc__ul_ak1_j1q_jcc">
<li class="li">
<strong class="ph b">Organization</strong>: Enter the Zendesk subdomain you're setting up
for advanced encryption.<p class="p">For example, if your support address is
<em class="ph i">support@mondocam.zendesk.com</em>, enter
<strong class="ph b">mondocam</strong>.</p>
</li>
<li class="li">
<strong class="ph b">KMS Config ID</strong>: Enter the KMS config ID that was created after
you <a class="xref" href="#topic_hny_3xp_jcc">added the KMS
configuration</a>.<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_ae_assign_KMS_config.png" width="500">
</p>
</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title9" class="topic nested1" id="topic_udb_l4p_jcc">
<h2 class="title topictitle2" id="ariaid-title9">Step 4: Activate advanced encryption</h2>
<div class="body">
<p class="p">The last step in the setup process is to activate advanced encryption.</p>
<p class="p"><strong class="ph b">To activate advanced encryption</strong></p>
<ol class="ol" id="topic_udb_l4p_jcc__ol_hwy_wbq_jcc">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Advanced encryption</strong>.</span></li>
<li class="li">Click <strong class="ph b">Next</strong>.<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_AC_activate_encryption.png" width="700"></p>
</li>
<li class="li">Select each checkbox to confirm you understand what will happen when you
activate advanced encryption. <p class="p">After all checkboxes are selected, the
<strong class="ph b">Activate encryption</strong> button becomes active.</p>
<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_confirm.png" width="400"></p>
</li>
<li class="li">Click <strong class="ph b">Activate encryption</strong>.</li>
</ol>
<p class="p">A progress bar displays the status of the data encryption process. The progress bar
appears green when complete, and an Activated entry appears in the Encryption
history table.</p>
<img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/AE_progress_activity.png" width="700">
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/5517626234138-Setting-up-advanced-encryption-ADPP-add-on",
"url": "https://support.zendesk.com/hc/en-us/articles/5517626234138-Setting-up-advanced-encryption-ADPP-add-on",
"headline": "Setting up advanced encryption (ADPP add-on)",
"description": "You can set up advanced encryption by requesting access, creating a Secure Configuration Portal account, configuring your Key Management Service access keys, and activating encryption to protect your service data with your enterprise KMS.",
"articleSection": "Protecting your customer's data",
"datePublished": "2023-03-22T19:39:24+00:00",
"dateModified": "2026-04-15T21:37:52.420046+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/5517626234138-Setting-up-advanced-encryption-ADPP-add-on"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script>
</body>