You agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.

AWS KMS vs Piiano Vault: Which Encryption Mechanism to Choose for Your PII Data

Privacy Engineering
Table of content:
Join our newsletter

Your privacy is important to us, privacy policy.

AWS KMS and Piiano Vault both provide encryption features. As most people have access to a KMS through their cloud provider, we're often asked why they should consider using Piiano Vault to encrypt their PII data.

In this post, we examine the encryption features of KMS and Piiano Vault. We show how Vault’s privacy-aware approach provides superior control and simplifies compliance with various privacy regulations and laws.

What are we talking about?

A Key Management Service (KMS) is a key encryption service used primarily to create, store, and control encryption keys. Cloud providers may then offer additional features. For example, as part of their KMS, AWS provides add-ons for:

  1. A limited-size blob encryption and decryption service.
  2. A client-side SDK that works around the size limitations of the encryption service.

Piiano Vault is a data protection service that stores or encrypts large amounts of sensitive personal data (PII, PHI, PCI, KYC, secrets, etc.), enabling compliance with standards and regulations such as PCI, CCPA, and GDPR. Vault uses AWS KMS for holding its root encryption key (KEK). Vault also offers stateless encryption APIs.

As described, a KMS and Piiano Vault offer a simple standalone REST API for a fully remote service to encrypt and decrypt your data. While a KMS is oblivious to the content of the data it encrypts, Piiano Vault focuses on semantic data types and privacy controls to assist with compliance and management of the sensitive data.

💡 This article discusses AWS KMS, but the same concepts hold true for GCP KMS and Azure Key Vault. We only reference the AWS implementation for brevity.

AWS KMS Encryption API

The AWS KMS encryption APIs provide functions to encrypt blobs and return them to applications, and decrypt ciphertext encrypted by the KMS. The encryption is done under a KMS key of your choosing. 

The KMS considers all data as blobs and cannot provide any added-value services on top of that data.

Main features

  1. Cryptographic operations: REST APIs (and AWS SDKs) to encrypt plaintext and decrypt ciphertext.
  2. The plaintext is limited to 4KB.
  3. The KMS requires the caller application to have IAM privileges.
  4. The encryption request includes:
    1. Encryption context: a list of non-secret key/value pairs representing additional authenticated data, which must be provided for the decryption.
    2. Grant tokens: a list of grant tokens. These grant authority to other AWS roles to work with the encrypted data.
    3. Key ID: the KMS ID, such as a key ARN. (e.g.arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab)
    4. The plaintext: Base64-encoded binary data object limited to 4096 bytes.

💡The AWS KMS does not store encrypted data. Storing and managing the encrypted data is up to you.

Piiano Vault Encryption API


Piiano Vault’s encryption APIs provide features to encrypt and decrypt data as well as easily update fields in encrypted objects. You can also obtain a hash of the source data without creating an encrypted object. In addition to these features available in the stateless version of Vault, the stateful version can also store data as you encrypt it.

Unlike a KMS, you define to Vault the schemas for the collections of sensitive data you want to encrypt. Vault is then aware of the semantic meaning of each field in the items encrypted or decrypted. On top of this, you can define identity and access management policies to control who and what can encrypt and decrypt data.

Main features

  1. Cryptographic operations: REST APIs (and Piiano SDKs for selected languages) to encrypt plaintext and decrypt ciphertext.
  2. Plaintext size is unlimited (for performance reasons, use blob types for larger records. The Vault roadmap includes support for files of many MBs).
  3. The encryption request includes:
    1. Validation: checks the data type of input against a data schema.
    2. Expiration: optionally expires encrypted content.
    3. Traceability: the reason for access, which is logged.
    4. Encryption type: randomized or deterministic.
    5. The plaintext: base64 cipher text.
    6. Scope: A friendly way to categorize and manage the data. An object encrypted with a scope can be decrypted only with the same scope.

Access to the Vault is managed through its own API keys.

Piiano Vault’s value-added services

In addition to simply encrypting a blob, Piiano Vault provides for:

  1. Configuring a schema for the data and validating the data being encrypted against that schema. This schema is defined using data types. Vault includes many common PII data types, along with their validators, normalizes, and transformers. You can also define custom data types.
  2. Configuring fine-grained field-level access control.
  3. Limiting access to certain fields by enabling the retrieval of a transformed value, such as the last 4 digits of a credit card.
  4. Auditing all access, including traceability and property-specific granularity.
  5. Enforcing expiration on objects and preventing their retrieval after the expiration lapses.
  6. Updating of a field within an encrypted data blob inside the Vault. Without this functionality, the entire blob must be brought in clear text to the application, updated there, and pushed back to the Vault. Vault’s approach avoids exposing sensitive information unrelated to the update.
  7. Injecting user logic for validation, transformation, and normalization using a built-in Javascript engine.
  8. Running as a binary or container, which is convenient for development and CI workflows. Data never leaves your cloud environment.

Piiano provides SDKs for Python, Java, and TypeScript and a command line tool. When using an ORM integration, Vault transparently encrypts and decrypts data for the objects you read and write from your database. That approach may be advantageous if you use an ORM and want to move from cleartext data to encrypted data with minimal changes to your code.

Piiano Vault versus KMS

For this comparison, we consider a system with the following characteristics:

  1. 1M records
  2. 1000 requests per second
  3. A small number of keys
  4. The region is Ohio (us-east-2)

💡AWS pricing information was taken from and ours here.

Features Piiano Vault KMS Encryption APIs
Price Encryption APIs are charged at a flat fee of approximately $1K USD per month. The infrastructure cost of running the Vault is approximately $0.5K USD per month.

Total: around $1.5K USD per month
The cheapest tier is $0.03 USD per 10K requests.

Total: around 7.7K USD per month
Plaintext limitations None Limited to 4K
Main use case Protecting sensitive personal data and complying with privacy regulations in cloud-native applications. Key management as well as simple encryption and decryption of a plaintext blobs.
Identity and access management Context-aware: designed for personal information, policies can reference specific fields of the data to be encrypted and decrypted. Standard AWS roles and policies that are configured and evaluated separately from the data being encrypted or decrypted.
Data redaction / minimization JavaScript engine to customize sensitive information redaction and data exposure minimization. N/A
Deployment Self-hosted as a container, ECS, over K8S, and Runs anywhere. Provided as SaaS.
Development experience A local container image is provided for testing, CI, and integration. There are some mocks that may be used for local development. Not available out-of-the-box.
Integration mode REST APIs, SDK, and ORM integration. REST API and AWS SDK.
Extensibility Upgrade to storing data within the Vault and creating tokens using the same API or SDK. Extend with a client-side SDK to overcome the 4K limitations. AWS does not provide a tokenization engine.


AWS KMS provides a proven key management and encryption service. However, as a tool to encrypt sensitive personal data, it is limited by the size of items it can encrypt and the cost. Also, integration may require some AWS expertise from DevOps or DevSecOps teams.

Piiano Vault’s encryption APIs provide a developer-ready solution for application data encryption (using a KMS internally to store keys for root trust and adequate security). The solution is geared towards backend developers and doesn’t require the user to be AWS proficient. It can also be much cheaper for certain use cases. Piiano Vault runs on the most popular cloud providers and can be deployed in various ways to meet your needs. It also provides a totally local developer environment.

Lastly, it’s worth mentioning that Vault has a broader scope than a KMS with respect to encryption. In its stateful implementation, it stores sensitive data and generates tokens, controls the lifecycle of objects and tokens, and has more features. And, all these features are available within the same API.

It's really easy to start using our Vault, create a free trial account here.

Share article

Powering Data Protection

Skip PCI compliance with our tokenization APIs

Skip PCI compliance with our tokenization APIs




It all begins with the cloud, where applications are accessible to everyone. Therefore, a user or an attacker makes no difference per se. Technically, encrypting all data at rest and in transit might seem like a comprehensive approach, but these methods are not enough anymore. For cloud hosted applications, data-at-rest encryption does not provide the coverage one might expect.

John Marcus

Senior Product Owner

const protectedForm = 
pvault.createProtectedForm(payment Div, 
Thank you! Your submission has been received!

We care about your data in our privacy policy

Oops! Something went wrong while submitting the form.