An assessor’s office hosts parcel documents in a cloud vector database. Which cryptographic data control best fits management expectations?

An assessor’s parcel-document vector database in the cloud still holds sensitive civic property records and derived embeddings. Using service-managed keys for the cloud vector database of parcel documents keeps key custody with the provider, so the office lacks independent rotation authority and cannot prove cryptographic control to auditors. Using service-managed keys for the cloud vector database of parcel documents weakens assurance, complicates exit, and may prevent the assessor from proving control to auditors because the provider retains custody of the keys. Encrypting TLS query sessions for the cloud vector database of parcel documents protects only the network path and does not give the office control over the keys protecting stored parcel documents, so it fails the expectation for customer-managed cryptographic custody. Applying field-level hashing for the cloud vector database of parcel documents may obscure identifiers but does not encrypt the parcel documents or provide customer-controlled key custody for the vector database, so it cannot satisfy the management expectation for independent cryptographic control. Exam caveat: AAISM data management for cloud AI stores favors customer-managed or otherwise controlled encryption keys over convenience cryptography. Operational check: enable CMK/KMS for the parcel vector store, restrict key administrators separately from data users, verify encryption at rest and in transit, and test key-rotation and emergency revoke procedures without corrupting retrieval availability.