Background
Background.
Professional services firm with client-confidential contact data. Their CRM, marketing automation and consent tracking ran on three vendors, each holding its own copy of every client contact.
Challenge
Challenge.
A client security review asked who could read the firm's contact data and under whose keys. The honest answer named three vendors and three key policies, and consent state differed between them.
The CTO wanted a structural fix: one platform, encrypted under the firm's own keys, with one consent record that every send checks.
Solution
Solution.
Pact Team ships BYOK encryption (per-tenant data keys wrapped by the customer's KMS) on the same SKU as the CRM. The team imported their CRM data and configured BYOK against their AWS KMS during setup.
Consent state migrated with the records, and the marketing journeys rebuilt in Pact check that one consent record before each send.
Result
Result.
One vendor now holds the client contact data, encrypted under the firm's own key. Key rotation runs on the team's schedule against their own KMS; key lineage is visible in the admin UI.