Encrypting data at the application layer with keys stuffed into environment variables might work for a side project — but it's a ticking time bomb in a multi-tenant AI platform handling millions of sensitive records daily. That's exactly the situation Ariso.ai found itself in before overhauling its entire cryptographic architecture using HashiCorp Vault. The result is a production-grade encryption system that any cloud engineer or DevSecOps professional can learn from.
The Problem: Shared Keys, Zero Isolation, and No Audit Trail
Before Vault, Ariso's AI assistant Ari relied on application-level encryption backed by manually managed keys stored in environment variables. On the surface, it worked. Under the hood, it was a security nightmare. A single compromised key could expose every tenant's data simultaneously. Key rotation required coordinated downtime. Cryptographic operations left no audit trail whatsoever — a serious red flag for any compliance team. And with each microservice managing its own keys, key sprawl made the attack surface grow with every new integration.
For a platform processing direct messages, meeting transcripts, personal reflections, coaching sessions, and third-party OAuth tokens, this was an unacceptable risk. Some data needed to be org-wide accessible, some strictly private to individual users, and some cryptographically unreachable the moment a session ended.
The Solution: Envelope Encryption with HashiCorp Vault Transit
Ariso adopted HashiCorp Vault's Transit secrets engine to implement envelope encryption across 21 database tables. The architecture uses Vault's context-based key derivation to generate three distinct isolation levels — organization, user, and session — all derived from a single master key. This means tenants are cryptographically separated without the operational overhead of managing thousands of independent keys.
The real engineering win here is the data encryption key (DEK) caching layer. Rather than hitting Vault on every read operation, the platform caches DEKs intelligently — producing an impressive 8:1 encrypt-to-decrypt ratio that confirms the cache is doing its job. Vault is called to generate or unwrap a DEK during writes, but decryption at scale happens locally. This is classic envelope encryption done right.
To eliminate the operational burden of self-hosting, Ariso chose HCP Vault Dedicated — HashiCorp's managed Vault offering — ensuring high availability without dedicating engineering cycles to Vault cluster management.
The Numbers That Matter
Performance metrics tell the real story. Vault-side transit latency clocked in at 0.46ms at the p50 (median) and just 0.63ms at p99 — extraordinarily low for a secrets management system operating at this data volume. Zero plaintext data exists in production across all sensitive fields. This is the kind of benchmark that separates a well-architected secrets strategy from one bolted on as an afterthought.
For engineers studying for the HashiCorp Vault Associate certification or working toward AWS SAA-C03 or AZ-900 credentials, this case study is a textbook example of envelope encryption, key hierarchy design, and the principle of least privilege applied to cryptographic operations — all core exam domains.
What This Means For You
If you're building or securing a multi-tenant SaaS platform — whether on AWS, Azure, or GCP — this architecture is worth studying closely. The combination of Vault Transit for key management, context-derived key hierarchies, and a local DEK caching layer gives you cryptographic isolation, audit visibility, and high-throughput performance without sacrificing developer velocity. Managed offerings like HCP Vault Dedicated lower the barrier to entry significantly. The days of storing encryption keys in .env files are over — and Ariso's numbers prove that doing it properly doesn't have to cost you latency.