The Vault encryption key is stored in Vault's backend storage.

Storing the unencrypted Vault encryption key directly in the backend storage would negate the purpose of Vault's security model, as the backend storage could then be compromised to access all secrets.

Vault employs a security barrier that encrypts all data written to the backend storage using a master key. This master key itself is never stored unencrypted in the backend; instead, it's split into key shares using Shamir's Secret Sharing or an auto-unseal mechanism, and these shares or unseal keys are used to reconstruct the master key to unseal Vault.