1. A method of managing tenant data that is transferred on a storage medium to a host data center, comprising: generating, using at least one processor, a custom key for the tenant, wherein the custom key is customized to the tenant, and wherein the custom key controls use of at least one service provided by the host data center out of a plurality of services provided by the host data center; encrypting, using at least one processor, at least a portion of the tenant data using the custom key, wherein the custom key controls access to the encrypted tenant data; encrypting, using at least one processor, the custom key using a public key provided by a public certificate of a Vault Service provided by the host infrastructure; storing the encrypted custom key and the encrypted tenant data on the storage medium; and after storing the encrypted custom key and the encrypted tenant data on the storage medium, physically transferring the tenant data to the host data center when the storage medium is transferred to the host data center; decrypting the custom key using a private key corresponding to the public key; decrypting the tenant data using the custom key; and following physically transferring the tenant data to the host data center, securely backing up the custom key at the host data center using a key management service that makes the custom key available to the tenant following authentication and authorization of the tenant.