Major German bank · Banking
A major German bank uses DuoKey Double Key Encryption to keep confidential client and internal data in Microsoft 365, while the second key stays outside Microsoft.
The problem
Banks move to Microsoft 365 for collaboration, but supervisors and DORA expect them to manage third-party risk on their most sensitive data. If the cloud provider holds every key, the bank cannot show who is able to read confidential files.
How DuoKey helps
DuoKey holds the second key for Double Key Encryption under the bank's control. Confidential content is protected through sensitivity labels and stays unreadable to Microsoft, while day-to-day work in Microsoft 365 continues as before.
How it works
01 / 04
An employee labels a client file or an internal report as highly confidential. Only this label uses Double Key Encryption.
02 / 04
Microsoft holds one key. DuoKey holds the second under the bank's control. The content is unreadable without both.
03 / 04
Staff with the right permissions open the file in Office or Outlook as usual. Every use of the bank's key is logged.
04 / 04
A request on the cloud side has only Microsoft's key. The file stays locked, and the bank has the evidence its supervisor expects under DORA.
Security leadership
What changed
DKE
Highly confidential content cannot be decrypted with Microsoft's key alone.
DORA
Key custody outside the cloud provider supports the bank's ICT third-party risk and exit planning.
Labels
Only content labelled highly confidential uses Double Key Encryption. Everything else keeps full Microsoft 365 features.
Proof
Every key request is logged by DuoKey for internal audit and the supervisor.
More programmes
Volkswagen
OTA that stays under OEM authority.
View case studyICRC
Beneficiary data sealed by keys the ICRC controls.
View case studySwiss energy operator
Board papers protected with a key Microsoft does not hold.
View case studySwiss fintech bank
Blockchain transactions signed without a complete key ever existing.
View case studyAutomotive manufacturer
PKI and certificate lifecycle, automated end to end.
View case studyOpenBAO Migration
Vault to OpenBAO Migration
View case studyTell us where control is difficult today. We will help you identify a practical next step.