> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/privileged-access-manager/cloud-security/keeper-encrypter.md).

# Keeper Encrypter

Deploy the Keeper Encrypter service for Keeper Cloud Security integrations.

Keeper Encrypter preserves Keeper's zero-knowledge architecture for Cloud Security integrations. It provides a secure, self-hosted path for CNAPP findings and remediation status.

### Why Keeper Encrypter exists

CNAPP providers send findings into Keeper. Keeper returns remediation status after an admin takes action. Keeper Encrypter handles that exchange without moving customer decryption into Keeper's cloud.

### How it works

* It runs as a Docker container in your environment.
* It receives inbound webhook traffic from the CNAPP provider.
* It encrypts integration payloads with a customer-managed 256-bit key stored in Keeper.

The service authenticates with Keeper using the device configuration you generate during setup. It reads the CNAPP configuration it needs through Keeper Secrets Manager. This keeps the integration aligned with Keeper's zero-knowledge model.

## Setup

{% stepper %}
{% step %}

### Generate a 256-bit encryption key

Use OpenSSL to generate the key:

```
openssl rand -base64 32
```

Save the generated value for use in the CNAPP configuration record.
{% endstep %}

{% step %}

### Configure DNS, SSL/TLS for Encrypter

Encrypter must be reachable by a public DNS host (subdomain suggested) that is configured by the customer. Inbound HTTPS traffic from Keeper and CNAPP provider's webhook must be routed to Encrypter.

* Customer configures a public DNS host/subdomain. For example:

  ```
  https://encrypter.customer-domain.com/
  ```
* Customer configures a load balancer for SSL/TLS termination that forwards inbound traffic on port 443 (HTTPS) to Encrypter's default port 80 (HTTP).
* Configure load balancer to use Encrypter's health check endpoint at `/health`.
  {% endstep %}

{% step %}

### Provision a gateway for Encrypter

* Select the same Keeper Secrets Manager application that is used by the PAM Configuration that's being linked to a CNAPP provider.
* Select **Gateways** tab.
* Click **Provision Gateway** button.
* Enter the **Gateway Name**.
* Select **Configuration** as the **Gateway initialization method**.
* Select **Linux** configuration.
* For **Config Type**, select **Base64**.
* Save the configuration for use as `DEVICE_CONFIG` below.
  {% endstep %}

{% step %}

### Complete the provider setup

[Configure Wiz](/keeperpam/privileged-access-manager/cloud-security/wiz-integration.md)

[Configure Tenable](/keeperpam/privileged-access-manager/cloud-security/tenable-integration.md)
{% endstep %}

{% step %}

### Configure and deploy Encrypter

* Edit the `docker-compose.yml` file downloaded during provider setup.
* Set `DEVICE_CONFIG` to the value saved in a prior step.
* Run Encrypter using the standard Docker command:<br>

  ```
  docker compose up -d
  ```

{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/privileged-access-manager/cloud-security/keeper-encrypter.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.