SAP Data Custodian Key Management Service review
A focused cloud service for SAP-centered key governance, BYOK, HYOK, and audit operations.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
SAP Data Custodian Key Management Service manages customer-managed encryption keys for SAP services and connected cloud environments. It is designed for mid-market and enterprise organizations operating SAP cloud workloads, including SAP BTP, SAP HANA Cloud, SAP Datasphere, and SAP SuccessFactors HCM. The service supports web and API access, with role-based administration, technical users, and API-based provisioning for operational control.
The strongest fit is SAP-centered governance across native and external key environments. Organizations can import keys through Bring Your Own Key (BYOK), register Hold Your Own Key (HYOK) arrangements, and perform native or external key rotation. Key enable, disable, backup, and restore operations support lifecycle administration, while keychain and envelope-encryption relationships address connected encryption workflows. Integrations include AWS Key Management Service, Fortanix DSM, Microsoft Azure Key Vault, and Thales CipherTrust Cloud Key Manager, alongside SAP platforms. This makes the service more suitable for organizations coordinating SAP workloads with existing cloud or external key-management infrastructure than for teams seeking a broad, platform-neutral tool.
Pricing follows a contact-sales model, and the service is provisioned as part of SAP Data Custodian and purchased services rather than presented as a standalone self-service plan. There is no free plan. Audit-log viewing and CSV export provide reporting support, while ticket-based support and documentation cover service assistance. The service should appeal to SAP customers that need BYOK or HYOK, rotation, access administration, and audit operations within a cloud deployment. Organizations seeking general-purpose key management across a wider range of environments may prefer a product with broader platform coverage.
SAP Data Custodian Key Management Service pros and cons
- Where it wins
- Supports both BYOK import and HYOK registration
- Connects SAP platforms with external key managers
- Includes rotation, lifecycle controls, and audit-log CSV export
- Where it doesn't
- Cloud deployment only
- Pricing requires contacting SAP sales
- Narrower fit than general-purpose key management platforms
SAP Data Custodian Key Management Service fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update