Key custody is the practical question of who controls decryption keys and who can recover them if access is lost. In encrypted cloud storage, this decides whether the provider can read user files, whether an account can be restored after a password reset, and whether sharing links or backups can expose plaintext. If the provider holds the keys, it may be able to decrypt data, comply with legal demands, or leak information in a breach. If the user holds the keys, privacy improves, but recovery becomes more fragile.
This matters in cyber security because attacks often target key custody rather than encryption itself. An attacker may steal backup keys, abuse recovery workflows, or compromise an admin account that can reissue access. Defenders reduce risk with client-side encryption, hardware security modules, multi-factor authentication, split recovery duties, and clear key-rotation procedures. Good key custody means knowing exactly where keys live, who can use them, and what happens when a device, account, or service fails.