> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/kms-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/kms-support/user-guide/publish-your-docs-1/key-lifecycle-policies.md). # Key lifecycle policies ## Objective **Key lifecycle policies objective:** * **Control how often** active encryption keys are rotated to reduce exposure and meet compliance requirements. * **Control how long** inactive keys and historical versions remain recoverable * **Permanently destroy** cryptographic keys after a defined grace period. ## Functions #### **1.** Rotation settings * Set the key rotation interval. * Apply it to all existing keys.

#### **2.** Retention settings * Defines the recovery window for disabled keys and historical versions before permanent deletion. * Keys remain recoverable during the retention period and become eligible for scheduled destruction once expired.

#### **3.** Scheduled destruction * Enables permanent deletion of cryptographic keys after a mandatory day grace period. * Ensures no immediate deletion, allowing keys to be recovered until the scheduled destruction date.

#### **4.** Dormant key detection * **Dormant key detection** automatically monitors key usage and classifies keys as **idle** or **dormant** when they have not been used within a defined period — helping you identify unused keys and take action before they become a security risk. * To configure, set the **Idle threshold** (number of inactive days before a key is marked idle) and the **Dormant threshold** (number of inactive days before a key is marked dormant). Dormant threshold must be greater than Idle threshold. Changes take effect on the next backend detection run.