Customer-Managed Encryption Keys is an encryption key management paradigm in which the cryptographic keys used to secure data are generated, stored, rotated, and controlled exclusively by the customer, distinguishing it from provider-managed or platform-managed key models by ensuring full custodial authority remains with the data owner.