What is key rotation?

Key rotation is replacing a cryptographic key with a new one and protecting data under the new key from then on, so that anyone who obtained the old key cannot read what is written after the change.

Why keys are rotated

NIST defines a key's cryptoperiod as the span of time during which a specific key is authorized for use. Keys are rotated when that period ends, and earlier whenever someone who held the key should no longer have it: an employee leaves, a laptop is stolen, a machine is taken out of service.

Rotation protects the future. It cannot reach into the past. If someone read a value while they had access, a new encryption key does nothing about the copy they already have.

Rotate versus reissue

Two kinds of replacement are easy to blur:

• Rotating an encryption key changes the key that protects stored data. The secret values inside stay the same.
• Reissuing a secret creates a new value at the provider, such as a new Stripe key or database password, and disables the old one.

After a leak or a departure you usually need both, and only the first can be automated by a vault that never sees provider credentials.

How Crunu handles rotation

Crunu uses "rotate" only for its own keys:

• Environment keys. Each environment has its own key. Removing a key holder, such as a member or a machine, is followed by rotation, and you can also start it with Rotate keys… in project settings. Removing a member rotates the key of every environment where they had one, and the Device compromised… flow does the same for every environment where you had a key.
• Organization keys. When an admin leaves, the organization's signing key and recovery key are replaced, certificates are reissued and all environment keys are rotated.
• The server key. Operators of a self-hosted server can rotate SERVER_KEY without signing anyone out or breaking share links. The previous key keeps working during the transition.

Changing your password or Secret Key does not re-encrypt your data.

Values at providers are a separate step. Crunu has no automatic rotation at providers. When someone leaves, the reissue checklist lists which values they could have read, without showing them, so you can reissue them at AWS, Stripe and other providers. See rotate environment keys and offboarding a teammate.

Sources

• NIST CSRC Glossary: cryptoperiod, checked October 27, 2026.