CoreWeave launches Remote Key Encryption with IBM as launch partner

CoreWeave has unveiled Remote Key Encryption, a service that encrypts customer data on its AI cloud using keys the company never holds. Encryption runs client-side inside the customer’s own compute boundary, with keys generated and stored in the customer’s existing secrets manager, key management system or hardware security module, so CoreWeave holds only ciphertext.

Access to nodes remains gated behind CoreWeave’s Support Access Management controls, and support engineers cannot reach them without the customer’s express permission. Key rotation, expiration and revocation run on the customer’s existing schedule and tooling, and CoreWeave said its key lifecycle management approach is patent pending.

The service enters limited availability later this year, with IBM as launch partner. The first release protects data on CoreWeave AI Object Storage using keys held in HashiCorp Vault, HashiCorp Vault Enterprise or any key management or hardware security product supporting the Key Management Interoperability Protocol. IBM acquired HashiCorp in February 2025.

CoreWeave also pointed to its identity work, including CoreWeave IAM, which federates with enterprise identity providers such as Microsoft Entra and Okta, and SUNK User Provisioning, which creates POSIX users and groups and Slurm accounts for training clusters.