Microsoft Double Key Encryption (DKE)
Keep Microsoft from unlocking regulated mail, files and Teams content alone, without leaving M365.
Product demo
Experience true data security for Microsoft 365
The Cockpit
Client, Azure RMS, your zero-trust policy layer, DKE Cockpit and the vault holding the key that never leaves your control, traced as one flow.
The problem
Default M365 encryption does not keep the provider off the key.
When the same party stores content and can unwrap it, sovereignty and compelled-access risk stay with the SaaS vendor. Sensitive mail, files and meetings are only as independent as the keys.
If Microsoft holds a wrapping key, it can reach the content.
Admin settings do not keep the provider off the key.
A request can target Microsoft, not your organisation.
Without a second key you control, M365 encryption is not independent.
Security leadership
Microsoft Double Key Encryption (DKE)
Four questions surface in every security review.
What changes
DuoKey for Double Encryption (DKE) uses distributed MPC technology and zero-trust controls to ensure Microsoft has zero access to your encryption keys, delivering complete data sovereignty with flexible deployment options and HSM integration.
Always client-side encryption is performed
No third-party can ever access your data
Dedicated tenant and vault for storing your keys
Manage key access with granular rules outside of Microsoft
Key benefits
Protecting cloud data, ensuring regulatory compliance and business continuity with DuoKey's DKE for Microsoft.
Meets strict regulatory requirements like GDPR, HIPAA and PCI DSS by implementing encryption standards that protect customer data and reduce legal liability risks
Maintains customer confidence and business operations by preventing costly data breaches, minimising downtime from security incidents and preserving brand reputation
Encrypts sensitive data both at rest and in transit, ensuring unauthorised users cannot access sensitive information even if they breach cloud storage or intercept data transfers.
Proof in practice
Deep dives
In detail
Enforce strict authorisation for every key access request through role-based permissions and multi-factor verification (eg. IP, Azure groups, location, user). Only verified users can access encryption keys, with continuous monitoring of all access attempts.
Products
Keep using AWS KMS in applications, while an external key store holds the authority Amazon lacks.
Tell us where control is difficult today. We will help you identify a practical next step.
