Collecting Evidence with Keep Aware Encrypted Storage

Store event artifacts in Keep Aware-managed, per-tenant storage without standing up a bucket of your own. Every artifact is encrypted with a public key that you generate in your browser, so only the matching private key can decrypt it. You hold that private key, and it's never sent to Keep Aware. Keep Aware keeps only the encrypted copy and can't read it. Encrypted evidence is retained for 30 days, then automatically deleted.

Use this destination when you want evidence collection without managing cloud storage or credentials, and you want to be the only party that can read the evidence.

Requirements

1. Access to the Keep Aware Console: Ensure valid login credentials are available and logged in to the console.
2. A secure browser context: Open the console over HTTPS. Key generation and decryption run in your browser and are unavailable on insecure origins.
3. A safe place to store the private key: A password manager or secrets vault to hold the private key you download during setup.

Getting started

Keep Aware provisions the storage for you. Setup happens in three parts:

• Generate: When you create the integration, Keep Aware generates an encryption keypair in your browser. The public key is sent to Keep Aware and used to encrypt evidence. The private key stays with you.
• Store: You download the private key once and save it somewhere safe. This is the only copy.
• Decrypt: To view or download evidence later, you load the private key back into the console. Decryption happens in your browser.

Because Keep Aware only ever receives the public key and the encrypted evidence, it can't read your evidence. There is no recovery and no key rotation, so the private key you save at setup is the only way to read anything encrypted with it.

Setting up the integration

To get started, navigate to the Integrations Page and select the Evidence Collection integration. This will open a modal. Then select Create New Integration and choose Keep Aware Storage.

View in console

Configuring the integration

Configure the integration, then generate your encryption key:

1. Enter a name for the integration.
2. Choose which artifacts to capture:
   • Capture screenshot: A screenshot of the tab or page where the event occurred.
   • Capture inputs: User inputs such as copy/paste operations and field entries.
   • Capture uploads: The contents of files the user uploaded.
   • Capture DOM: The HTML Document Object Model of the page where the event occurred.
3. Select Save. Keep Aware generates the encryption key in your browser and opens the Generate encryption key dialog.

You can create up to three Keep Aware Storage integrations. Each one provisions its own storage and has its own encryption key.

Saving your private key

The Generate encryption key dialog creates your keypair and asks you to back up the private key before the integration is created.

warning

This is the only copy of the private key. If you lose it, evidence encrypted with this key can never be viewed. There is no recovery and no rotation. Keep Aware never stores it.

1. Select Download private key. Keep Aware downloads a .pem file named for the integration, such as keepaware-evidence-collection-private-key.pem.
2. Store the file somewhere safe, such as a password manager or secrets vault.
3. Select the I have saved this private key in a secure location checkbox.
4. Select Continue to finish creating the integration.

Continue stays disabled until you download the key and select the checkbox. If you select Cancel, the integration isn't created and no key is kept.

Collecting evidence in a policy

To enable evidence collection, navigate to Integrations in the policy editor and select this integration under Evidence Collection.

When an event matches the policy, artifacts are captured, encrypted with your public key, and stored by Keep Aware as ciphertext.

Viewing and downloading evidence

Encrypted evidence appears in event details, the same as other evidence integrations. Viewing or downloading it requires the integration's private key loaded in your browser.

• Reveal an input value: The Input Value row is masked as ••••••. Select the eye icon to fetch and decrypt the value and reveal it. Select it again to hide the value.
• Download the evidence: Select Download Evidence. Keep Aware fetches the encrypted artifacts, decrypts them in your browser, and downloads a zip of the decrypted files.

If no private key is loaded for the integration, Keep Aware shows a No decryption key loaded message. Select Load key to load it in place, or Manage in Settings to open the Evidence keys tab. When you start a download with no key loaded, Keep Aware prompts you to load the key first, then continues.

If decryption fails, Keep Aware reports that it couldn't decrypt the evidence with that key and removes the loaded key. Load the correct private key for the integration and try again.

Managing decryption keys

Load and manage private keys under Settings, in the Integration group, on the Evidence keys tab. This tab lists each encrypted evidence integration and whether a key is loaded for it.

Keys are stored only in your browser and persist across reloads until you sign out. Each console user loads their own keys.

Loading a key

1. On the Evidence keys tab, select Load key next to the integration.
2. Select Upload private key (.pem) to choose the .pem file, or paste the private key into the field.
3. Select Load key.

When a key is already loaded, the button reads Replace. Loading a new key replaces the current one.

Removing a key

Select Remove next to a loaded integration, then confirm. Keep Aware removes the key from this browser. You'll need to re-upload the private key to view that integration's evidence again.

Frequently asked questions

Question	Answer
Where is the evidence stored?	In Keep Aware-managed, per-tenant storage. You don't provision or manage a bucket.
Can Keep Aware read my evidence?	No. Evidence is encrypted with your public key, and Keep Aware never receives the private key, so it only ever holds ciphertext.
What happens if I lose the private key?	Evidence encrypted with that key can't be recovered. There is no recovery and no key rotation. Store the key you download at setup somewhere safe.
How long is evidence kept?	Encrypted evidence is retained for 30 days, then automatically deleted.
Do my loaded keys sync across devices or browsers?	No. Keys are stored only in the browser where you load them and are cleared when you sign out. Load your private key on each browser where you view evidence.