How does the Publisher manage encryption keys?

When a new piece of content is ready for encryption, the publisher requests a new key from the ARALOC Management Console. A new key is generated and transmitted to the publisher. The key is not stored on the file system, and is not available after the encryption is complete.