Databricks has introduced customer-managed keys (CMK) for its Lakehouse Postgres offering, allowing users to control their data encryption and utilize their own Key Management Service (KMS) from major cloud providers like AWS KMS, Azure Key Vault, or Google Cloud KMS. The Lakehouse Postgres architecture features a hierarchical envelope encryption model with three tiers: the customer-managed root key (CMK), a Key Encryption Key (KEK) used by Databricks' Key Manager Service, and unique Data Encryption Keys (DEKs) for each data segment. If a CMK is revoked, access to the data is denied, and active compute instances are terminated, serving as a failsafe for high-compliance workloads. The implementation allows for granular control over key management and supports seamless key rotation without data re-encryption or downtime. All cryptographic operations are logged within the customer's cloud audit services, available to Databricks Enterprise tier customers.