Encrypt SQL Server databases

SQL Server Transparent Data Encryption with the key outside the database host, through an Extensible Key Management (EKM) provider backed by DuoKey.

Key off the host

The key that protects the database encryption key never sits on the SQL Server.

No application change

TDE is transparent: queries and applications keep working.

Audit-ready

Every key use logged for GDPR, HIPAA and PCI DSS reviews.

TDE with the key somewhere else.

SQL Server encrypts data files, logs and backups with a database encryption key. An EKM provider holds the asymmetric key that wraps it, outside the server.

Stolen files and backups are useless without that key.
SQL Server 2016 or later, Enterprise or Developer, on Windows.

The EKM provider, backed by DuoKey.

The DuoKey SQL EKM provider loads into SQL Server and sends wrapping operations to the vault you chose: software, MPC or a supported HSM.

HSMs from Securosys, Thales, Entrust, Utimaco, Fortanix and more.
Fits existing SQL Server configurations.

Policies on every key.

Define who and what may use each key, with access controls set per database or per environment.

Custom key policies for SQL Server databases.
Rotation without re-encrypting the data files.

An audit trail for every use.

Key usage, access patterns and management actions are logged, so compliance reviews and investigations have the evidence they need.

Reports for GDPR, HIPAA and PCI DSS.
Same Cockpit as your other database and cloud keys.

SQL Server TDE

Always Encrypted

Backups

DuoKey SQL EKM

Securosys HSM

MPC vault

Software vault

TDE or Always Encrypted: both covered.

TDE protects files and backups. Always Encrypted keeps chosen columns encrypted even from database administrators, with DuoKey holding the column master key.

Pick TDE when stolen files must be useless.
Pick Always Encrypted when DBAs must not read a column.

Key features

Centralised key management

Create, store and rotate SQL keys from one console.

Custom key policies

Access controls per database and environment.

HSM support

Securosys, Thales, Entrust, Utimaco, Fortanix and HashiCorp Vault backends.

Audit and compliance

Usage and management logs for regulators.

Dedicated tenant and vault

Your keys in their own tenant and vault.

Monitoring

See who uses your keys and when.

Deploy it your way

Keep SQL Server where it runs and choose where its keys live.

DuoKey Cloud

SaaS

Keys served by DuoKey to your SQL Servers.

On-premises

Your data centre

Keys and Cockpit in your own environment.

TDE vs Always Encrypted

Guide

Which one you need, and how to set it up.

Database key management

Guide

Where the master key lives, engine by engine.

DORA

Use case

Encryption and key control for financial entities.

Try it out

Free trial

Open a Cockpit tenant and connect a first SQL Server.

Proof in practice

Where teams deploy this

Infrastructure

KMIP Key Management Server

One KMIP key manager for hypervisors, storage and databases, with keys kept off the hosts they encrypt.

Read use case

Financial Services

Secure Cloud Data Storage for Financial Services

Protect Customer Data and Ensure Compliance with DuoKey's Secure Cloud Storage for the Financial Industry

Read use case

Financial Services

Data Encryption for DORA Compliance

Meet DORA's requirements for encryption and key management with customer-controlled keys across cloud and SaaS.

Read use case

Deep dives

Field guides for your programme

SQL Key Management and Database Encryption: Where the Master Key Lives

Database encryption key management is where the master key lives. How SQL Server, Oracle, MySQL, PostgreSQL, MongoDB, Cassandra and Couchbase keep that key off the database, with DuoKey.

Read guide

SQL Server EKM Provider and External Keys: TDE vs Always Encrypted (2026 Guide)

What a SQL Server EKM provider is, how to register one for TDE in T-SQL, which providers exist, and when Always Encrypted is the better fit.

Read guide

You're Encrypting Your Data. But Who Controls the Keys?

Encrypted is not the same as controlled: a plain-language brief for leaders on who can unlock cloud data when a provider holds the last key.

Read guide

Compliance

Frameworks this product supports

DORA

ICT risk management and resilience for the EU financial sector, with encryption and keys you can prove you control.

Open framework

PCI DSS

Payment Card Industry Data Security Standard. Key custody, split knowledge and encryption for account data environments.

Open framework

GDPR

Article 32 security, breach risk and transfers, encryption that is meaningful because you hold the keys.

Open framework

Trust

Assurance and customer programmes

ISO

ISO/IEC 27001:2022

Certified information security management system.

Security at DuoKey

Trust Center

Security and compliance documents for due diligence.

Open Trust Center

Customer programmes

Volkswagen · Automotive

OTA that stays under OEM authority.

DuoKey keeps PKI and signing with one of the world's leading automotive manufacturers, including at the edge, on the platforms already in production.

View case study

ICRC · Humanitarian

Beneficiary data sealed by keys the ICRC controls.

RedSafe, the ICRC's digital platform for people affected by conflict, encrypts beneficiary data with HashiCorp Vault. DuoKey auto-unseals Vault with an MPC-protected key under ICRC control, so no operator holds unseal keys and no hosting provider can open the data.

View case study

Swiss energy operator · Energy · Critical infrastructure

Board papers protected with a key Microsoft does not hold.

A Swiss critical-infrastructure operator in the energy sector uses DuoKey Double Key Encryption to keep its board's most sensitive documents in Microsoft 365, with the second key under its own control.

View case study

Major German bank · Banking

Microsoft 365 for a bank, with the key in the bank's hands.

A major German bank uses DuoKey Double Key Encryption to keep confidential client and internal data in Microsoft 365, while the second key stays outside Microsoft.

View case study

Swiss fintech bank · Banking · Digital assets

Blockchain transactions signed without a complete key ever existing.

A leading Swiss fintech bank secures its blockchain transactions with DuoKey MPC: signing keys are split into shares, and a transaction is signed only when policy and approvers agree.

View case study

Automotive manufacturer · Automotive · PKI

PKI and certificate lifecycle, automated end to end.

An automotive manufacturer uses DuoKey to run its PKI and automate the certificate lifecycle across IT, plants and connected services, so an expired certificate no longer stops the business.

View case study

OpenBAO Migration · Secrets management

Vault to OpenBAO Migration

Escape HashiCorp Vault Enterprise's per-token licensing and BSL vendor lock-in. Migrate to OpenBAO with DuoKey SD-HSM MPC auto-unseal and DuoKey Managed OpenBAO Service: same API, zero code changes and up to 60-80% lower TCO (estimate; depends on tokens, support and HSM estate).

View case study

SQL Server encryption, key off the host.

See TDE with an external key on your own SQL Server.

Request a demo Start a free trial

Products

Check out the other DuoKey products

Microsoft Double Key Encryption (DKE)

Keep Microsoft from unlocking regulated mail, files and Teams content alone, without leaving M365.

View product