1--- 2layout: "docs" 3page_title: "Seals - Configuration" 4sidebar_title: "<code>seal</code>" 5sidebar_current: "docs-configuration-seal" 6description: |- 7 The seal stanza configures the seal type to use for additional data protection. 8--- 9 10# `seal` Stanza 11 12The `seal` stanza configures the seal type to use for additional data 13protection, such as using HSM or Cloud KMS solutions to encrypt and decrypt the 14master key. This stanza is optional, and in the case of the master key, Vault 15will use the Shamir algorithm to cryptographically split the master key if this 16is not configured. 17 18As of Vault 0.9.0, the seal can also be used for [seal wrapping][sealwrap] to 19add an extra layer of protection and satisfy compliance and regulatory requirements. 20This feature is only available in Vault Enterprise. 21 22For more examples, please choose a specific auto unsealing technology from the 23sidebar. 24 25## Configuration 26 27Seal configuration can be done through the Vault configuration file using the 28`seal` stanza: 29 30```hcl 31seal [NAME] { 32 # ... 33} 34``` 35 36For example: 37 38```hcl 39seal "pkcs11" { 40 # ... 41} 42``` 43 44For configuration options which also read an environment variable, the 45environment variable will take precedence over values in the configuration file. 46 47[sealwrap]: /docs/enterprise/sealwrap/index.html 48