Reconciled forecast
Sales/revenue forecast in a HIERARCHY (SKU → customer → region → total) reconciled so that the levels ADD UP exactly. A forecast that doesn't reconcile is the #1 reason owners lose trust in it: if the sum of the SKUs doesn't match the total, which number is the real one? Here you see the RAW value …
What you find on this screen
A portrait of the screen, read from the screen itself — it changes when the screen changes.
Available actions
DeactivateReactivateYesNoSave
The list shows
TenantStatusAlgorithmDefined onRotated onActions
Form fields
Chave Cifrada
Algoritmo
Ativa
Dh Definicao
Dh Rotacao
Start here
You are warned before the month closes
BYOK (Bring Your Own Key) means the tenant has its own encryption key instead of sharing the platform's. Its key is stored ENCRYPTED by the master key (envelope encryption) — never in clear text, never displayed back. Use it when a customer requires its own key by contract or compliance; for everyone else, the platform key remains the default and nothing changes.
What this screen is
Super admin screen for BYOK (Bring Your Own Key): per tenant, the status of its own encryption key and the actions to set, rotate and deactivate it. The tenant's key is stored encrypted by the platform key (envelope encryption), never in clear text; it applies to the tenant's new data from the moment it is set. Without an active own key, the system uses the platform key, as it does today.
How to
Set and Rotate
The button opens the key dialog: type the tenant's secret — recommended Base64 of 32 bytes (AES-256). On saving, it is encrypted by the master key and disappears from the screen forever. Rotating is the same gesture: set a new key over it, and the "Rotated on" column records when.
Deactivate and Reactivate
Deactivating keeps the key stored but returns the tenant to the platform key (yellow "inactive" status). Reactivating resumes its own key. Neither deletes anything — it is a switch per tenant, with confirmation before deactivating.
Rules
The global switch comes before the key
The SEGURANCA.BYOK_ATIVO parameter turns on the entire mechanism. With it OFF, setting a key here has no effect at all: the system stays on the platform key, and the screen warns in red. First the switch in Platform parameters, then the tenant's key.
Trocar a chave NÃO recifra o acervo antigo
The new key applies to NEW data from then on. What was already stored remains encrypted as it was — re-encrypting the existing data is a separate process that does not happen on this screen. Rotating here and assuming the existing data has been switched is the classic BYOK trap.
Frequently asked questions
What each status means
Green "active" = tenant encrypting new data with its own key. Yellow "inactive" = has a stored key but is using the platform's. Gray "no key" = never set one — the normal state of most tenants.
Which question this screen answers
Can each tenant use its own encryption key — and what is the status per account? The super admin screen lists, per tenant, the state of its own key (BYOK) and the actions to set, rotate and deactivate it. The tenant's key is stored encrypted by the platform key (envelope encryption), never in clear text, and applies to NEW data from the moment it is set — changing the key does not re-encrypt the old data. Without an active own key, the tenant keeps using the platform key, as it always has.
Was this article helpful?
In the same module: Confiança e conformidade1
Tenka Academy
Explore the AcademyStep-by-step learning paths for your industry, inside the platform.