USM Content
Leverage advanced features like encryption keys for superior data protection.
Customer Managed Encryption Keys
USM Content
Customer Managed Encryption Keys (CMEK) is a purchasable add-on that lets you bring your own encryption key—stored in Amazon Web Services (AWS) Key Management Service (KMS)—to add an extra layer of encryption to your Smartsheet data. Because CMEK requires a sales-assisted setup, contact your Smartsheet account team to get started.
You need an active AWS Key Management Service plan to use this feature.
Who uses CMEKs
CMEK is designed for organizations with sensitive or regulated data that require direct control over their encryption keys. With CMEK, eligible customers can use Smartsheet while maintaining full control over customer data stored in the application.
How CMEKs work
Smartsheet already encrypts all stored data at rest with 256-bit AES encryption using Smartsheet-managed keys. CMEK adds a second layer of 256-bit AES encryption on customer data—specifically cell and column data—using a Customer Master Key (CMK) that you control within AWS KMS. This transfers control over the accessibility of that data to you.
You can revoke Smartsheet access to customer data at any time by destroying the CMK in AWS KMS. Destroying the key makes the associated customer data unrecoverable within Smartsheet.
Destroying a CMK makes data unrecoverable, but it may not meet your specific legal or regulatory requirements. Consult your legal team about your compliance obligations.
Enable CMEK with AWS KMS
CMEK enablement is an assisted process. Contact your Smartsheet account team to begin—they provide the details you need for step 1.
Once you purchase the CMEK add-on:
- Obtain the details needed to configure a CMK from Smartsheet.
- Configure the CMK in AWS KMS.
- Provide the Amazon Resource Name (ARN) to Smartsheet to complete the configuration steps.
Once the enablement process is complete, all newly created customer data is CMEK-encrypted. Existing customer data remains accessible and is encrypted through a data migration process. You receive a notification when the migration finishes.
What data in Smartsheet does CMEK encrypt?
Cell and column data (customer data) are typically considered critical or sensitive and can be encrypted with CMEK. Other content—such as images, attachments, comments, proofs, and AI conversations—is encrypted at rest and in transit using Smartsheet’s standard encryption methods but cannot be encrypted with CMEK at this time.
Are assets automatically encrypted when transferred to a CMEK-enabled plan?
No. Assets transferred to a CMEK-enabled plan after CMEK activation and completed migrations aren't automatically encrypted.
How should CMKs used for CMEK be maintained in AWS KMS?
Establish processes to prevent accidental deletion of CMKs used for Smartsheet CMEK within AWS KMS. If a CMK used for Smartsheet data encryption is deleted, the associated customer data becomes unrecoverable.
What type of CMK rotation does Smartsheet support?
Smartsheet supports auto-rotation of CMKs through AWS KMS. Smartsheet doesn't support manual rotation of CMKs. For additional information on how to enable auto rotation of CMKs in AWS KMS, see Rotating customer master keys - AWS Key Management Service.
What happens if a CMEK is deleted?
If a CMK used with Smartsheet CMEK is deleted, it can't be recovered, and Smartsheet can't decrypt the associated customer data. Under these circumstances, customer data in Smartsheet is effectively lost. Make sure your AWS KMS management processes prevent accidental deletion of CMKs.
What should you do if the CMK in AWS KMS has been scheduled for deletion?
Reprovision the CMK in AWS KMS. In some cases, if the waiting period defined in your AWS KMS console for key deletion has passed, it may not be possible to regain access to customer data encrypted with the deleted key.
For more information on deletion of CMKs in AWS KMS, refer to Deleting customer master keys - AWS Key Management Service.
Is CMEK available in Smartsheet Gov?
No. Currently, this feature is only available in Smartsheet commercial.