Data Sovereignty for Enterprise SaaS: Microsoft 365, AWS & Customer-Managed Keys
If your organization uses AWS, Microsoft 365, or any enterprise AI tool and wants to evaluate data sovereignty, the direct answer is this: cloud-native key management — AWS KMS with provider-managed keys, or Microsoft-managed encryption in Office 365 — does not constitute data sovereignty. It constitutes data protection under someone else's control. True sovereignty requires that cryptographic keys are generated, stored, and operated exclusively in infrastructure your organization controls, with no unilateral access possible by any third party, including your cloud provider. This guide helps security architects understand exactly where controls should live and how to evaluate solutions that meet the bar.
The Sovereignty Illusion: Why "Encrypted in the Cloud" Is Not Enough
Every major cloud platform encrypts your data by default. AWS encrypts S3, RDS, and EBS at rest. Microsoft 365 encrypts mailboxes, SharePoint, and Teams content. This is not controversial — it is table stakes.
The problem is key custody. When your cloud provider encrypts your data with keys they also manage, they retain the technical ability to decrypt that data. This matters in three specific scenarios that compliance frameworks are beginning to address explicitly:
- Legal compulsion: The US CLOUD Act allows US courts to compel cloud providers — including Microsoft and Amazon — to produce customer data from servers anywhere in the world, without notifying the data subject. European organizations handling personal data under GDPR face an irreconcilable conflict.
- Insider threats: Cloud provider employees with elevated access privileges can, in principle, access key material. Major providers implement controls, but the capability exists.
- Breach scenarios: A sufficiently sophisticated compromise of cloud provider infrastructure could expose both encrypted data and the keys protecting it, if both reside in the same trust boundary.
Data sovereignty — as defined by GDPR Article 32, NIS2 Article 21, and the DORA Regulation — requires that your organization demonstrate exclusive cryptographic control. Cloud-managed keys do not support that demonstration.
The Sovereignty Spectrum: A Framework for Evaluating Where Controls Should Live
Security architects evaluating key management options face a spectrum of control models. The table below maps the five main approaches to their sovereignty depth, compliance posture, and operational complexity.
| Control Model | Key Location | Provider Access? | Sovereignty Depth | Compliance Fit |
|---|---|---|---|---|
| Provider-managed keys (default) | Cloud provider HSM | Yes — full | None | Basic |
| Customer Managed Keys (CMK) in cloud KMS | Cloud provider HSM | Yes — operational | Low | Partial |
| BYOK (key import into cloud KMS) | Cloud provider HSM (after import) | Yes — operational | Low-Medium | Partial |
| External Key Management (XKS / DKE) | External HSM / KMaaS | No | High | Strong |
| External KM with dual-control HSM | External HSM, dual authorization | No — not even vendor | Maximum | Full |
Key insight: The first three rows all leave your cloud provider with technical access to key material during operations. Only external key management — where cryptographic operations happen outside the cloud provider's trust boundary — achieves genuine sovereignty.
Microsoft 365: Evaluating Your Key Management Options
Option 1 — Microsoft-Managed Keys (Default)
By default, Microsoft manages encryption keys for all Microsoft 365 services: Exchange Online, SharePoint, Teams, OneDrive. Your data is encrypted, but Microsoft holds the keys. A CLOUD Act order served to Microsoft can compel decryption without your involvement.
Sovereignty depth: 0/5
Option 2 — Customer Key (BYOK into Azure Key Vault)
Microsoft's Customer Key feature allows organizations to provide their own root encryption keys, imported into Azure Key Vault. This improves your control posture — you can revoke access by deleting your key — but Azure infrastructure still handles the unencrypted key during cryptographic operations.
Microsoft's own documentation states: "Microsoft does not have access to the root keys that you maintain in Azure Key Vault. However, they can access the data encryption keys derived from your keys."
Sovereignty depth: 2/5 — Better than default, but not true sovereignty.
Option 3 — Double Key Encryption (DKE)
Microsoft 365 Double Key Encryption is the only Microsoft option that achieves genuine sovereignty. DKE encrypts sensitive documents with two keys: Microsoft's key and your external key. Both are required to decrypt. Microsoft never holds your external key.
DuoKey provides a certified DKE service where your external key is stored in DuoKey's HSM-backed MPC infrastructure, with dual-control authorization — meaning no single party (including DuoKey) can access or use the key unilaterally.
Sovereignty depth: 5/5 — The only model where Microsoft cannot decrypt your data.
DKE architecture: two independent keys are required. Microsoft's infrastructure never holds the external key.
AWS: Evaluating Your Key Management Options
Option 1 — AWS-Managed Keys (Default)
AWS services encrypt data using AWS-managed CMKs. Simple, zero operational overhead, and entirely within Amazon's control. CLOUD Act compulsion, insider threats, and AWS account compromise all apply.
Sovereignty depth: 0/5
Option 2 — AWS KMS with Customer Managed Keys (CMK)
You create CMKs in AWS KMS, control rotation policies, and grant access through IAM policies. This is a material improvement in governance and auditability. However, AWS KMS performs all cryptographic operations — the key material resides in AWS HSMs.
Sovereignty depth: 2/5 — Strong auditability, but AWS retains operational access to key material.
Option 3 — AWS External Key Store (XKS)
AWS XKS lets you use AWS KMS API calls while routing cryptographic operations to your own external key manager via an XKS Proxy. AWS never receives unencrypted key material — all encrypt/decrypt operations happen in your infrastructure.
DuoKey provides a production-ready XKS Proxy that connects AWS KMS to DuoKey's MPC Vault. Key operations are authorized through dual-control policy, logged immutably, and your keys never enter AWS infrastructure.
Sovereignty depth: 5/5 — AWS can be compelled to produce encrypted ciphertext; they cannot produce the key to decrypt it.
XKS architecture: all cryptographic operations are routed to the external DuoKey MPC Vault. AWS processes ciphertext only.
Enterprise AI Tools & BYOK: Where Do Controls Live for Copilot, ChatGPT Enterprise, and Genesys?
The rise of enterprise AI tools — Microsoft 365 Copilot, ChatGPT Enterprise, Genesys AI — introduces a new sovereignty problem. These tools process your organizational data (emails, documents, CRM records, call transcripts) to generate insights and responses.
Key questions for security architects:
- Does the AI tool process data using provider-managed keys? If yes, the AI vendor can be compelled to access your organizational data.
- Can you apply your external key management to the data the AI tool accesses? This depends on whether the underlying data store (Microsoft 365, Salesforce, S3) supports external key management.
- Is the AI tool's output stored and encrypted under your control?
The correct approach is to enforce external key management at the data layer — before AI tools ingest your data. If your Microsoft 365 content is protected by DKE, Copilot processes only data you have explicitly authorized for AI consumption, and you retain revocation rights.
DuoKey's integration with Microsoft 365 DKE and AWS XKS means you can apply sovereign encryption to the data sources that enterprise AI tools draw from — maintaining SOC 2 control requirements for AI data governance.
KMaaS: Key Management as a Service
Key Management as a Service (KMaaS) addresses the operational challenge of running enterprise-grade key management without building and operating your own HSM infrastructure.
Traditional external key management required significant capital investment: dedicated HSM hardware ($20,000–$100,000+), colocation costs, specialist staff, firmware lifecycle management, and compliance recertification cycles.
KMaaS delivers the same cryptographic controls — HSM-backed key storage, dual-control authorization, immutable audit logging, key rotation and revocation — as a subscription service. Organizations access external key management through API without managing physical hardware.
DuoKey's KMaaS model includes:
- HSM-backed MPC Vault — keys are distributed across MPC nodes with no single point of compromise
- Dual-control authorization — every key operation requires authorization from two independent parties; DuoKey cannot access keys unilaterally
- Certified connectors for Microsoft 365 DKE, AWS XKS, Salesforce Cache-Only Key, ServiceNow, and HashiCorp Vault
- Transparent subscription pricing — no per-operation charges that scale unpredictably with usage
- Swiss data centre deployment — key material remains in Swiss jurisdiction under Swiss law, addressing EU data sovereignty requirements under Schrems II
The Compliance Case: What SOC 2, GDPR, NIS2, and DORA Actually Require
SOC 2 Type II and Key Access Governance
SOC 2's CC6 (Logical and Physical Access Controls) and CC9 (Risk Mitigation) criteria require organizations to demonstrate that access to encryption keys is restricted, logged, and reviewed. Cloud-native KMS partially satisfies this — AWS CloudTrail and Azure Monitor capture key usage events. However, auditors increasingly ask whether the key management provider itself could access keys, and whether dual authorization is enforced.
External key management with dual-control authorization provides a clean, auditable answer: no single party — including the KMaaS provider — can access key material unilaterally. This maps directly to the separation of duties requirements that SOC 2 auditors look for in high-assurance environments.
| SOC 2 Criterion | Cloud-Native KMS | External KM with Dual Control |
|---|---|---|
| CC6.1 — Restrict logical access | Partial (IAM policies) | Full (dual authorization required) |
| CC6.2 — Access provisioning | Partial | Full (policy-driven, auditable) |
| CC6.3 — Remove access | Partial | Full (instant revocation) |
| CC7.2 — Monitor system components | Partial | Full (immutable key audit log) |
| CC9.2 — Risk mitigation | Provider dependency | Provider independence |
GDPR Article 32 and Demonstrable Control
GDPR requires "appropriate technical and organisational measures" including encryption. Post-Schrems II, European data protection authorities have interpreted "appropriate" to mean that keys must be held in a way that prevents unauthorized access — including by US-based cloud providers under CLOUD Act compulsion.
External key management with Swiss-domiciled key storage provides the architecture to demonstrate this control to regulators and in DPIAs (Data Protection Impact Assessments).
NIS2 and DORA: Cryptographic Supply Chain Risk
NIS2 Article 21 requires documented cryptographic policies and supply chain risk management. Relying solely on cloud-provider KMS creates a dependency that NIS2 auditors flag: if your cloud provider's KMS is compromised or compelled, your cryptographic controls fail.
DORA's third-party risk requirements explicitly require financial entities to demonstrate ongoing control over critical ICT suppliers — including key management infrastructure.
Evaluation Scorecard: DuoKey vs Cloud-Native KMS
Use this framework to score key management options against the criteria that matter for enterprise sovereignty decisions.
| Evaluation Criterion | Weight | AWS KMS (CMK) | Azure Key Vault BYOK | DuoKey External KM |
|---|---|---|---|---|
| Sovereignty depth (provider cannot access keys) | 30% | ✗ No | ✗ No | ✓ Yes |
| HSM backing (FIPS 140-2 Level 3) | 20% | ✓ Yes | ✓ Yes | ✓ Yes (MPC + HSM) |
| Dual-control authorization | 15% | ✗ No | ✗ No | ✓ Yes |
| Multi-cloud compatibility | 15% | AWS only | Azure only | ✓ AWS, M365, Salesforce, ServiceNow |
| Immutable audit log | 10% | ✓ CloudTrail | ✓ Azure Monitor | ✓ Independent log |
| Instant revocation | 5% | Partial | Partial | ✓ Immediate |
| Pricing transparency | 5% | Per-request metering | Per-operation | ✓ Flat subscription |
| Composite score | 40/100 | 38/100 | 92/100 |
Decision Tree: Where Should Your Cryptographic Controls Live?
Work through these four questions to determine the right control architecture for your organization:
1. Does your organization handle data subject to GDPR, NIS2, DORA, HIPAA, or PCI-DSS? → Yes: Cloud-native KMS (provider-managed) is not sufficient. Proceed to question 2. → No: AWS KMS CMK or Azure Customer Key may be adequate.
2. Do your regulators or auditors require that no third party — including your cloud provider — can access decryption keys? → Yes: External key management with dual-control authorization is required. → No: Customer Managed Keys (CMK) in cloud KMS may satisfy requirements.
3. Do you use Microsoft 365 for sensitive documents, email, or AI (Copilot)? → Yes: Evaluate Microsoft 365 Double Key Encryption (DKE) with an external key service. → No: Proceed to question 4.
4. Do you use AWS for sensitive workloads (databases, S3, analytics)? → Yes: Evaluate AWS External Key Store (XKS) with an HSM-backed external proxy. → No: Review your SaaS applications individually for external key management support.
If your answers lead to external key management: DuoKey provides a unified KMaaS platform covering Microsoft 365 DKE, AWS XKS, Salesforce, ServiceNow, and Snowflake through a single control plane (DuoKey Cockpit) with transparent subscription pricing.
How DuoKey Implements External Key Management
DuoKey explicitly does the following — not as marketing language but as technical specifications:
- DuoKey stores encryption keys in an HSM-backed MPC Vault. Key material is split across geographically distributed MPC nodes. No single node holds a complete key.
- DuoKey enforces dual-control authorization on all key operations. Every encrypt, decrypt, sign, or verify operation requires approval from two independent authorization parties. DuoKey staff cannot access key material unilaterally.
- DuoKey is compatible with Microsoft 365 Double Key Encryption. The DuoKey DKE service is a certified external key endpoint for Microsoft's DKE implementation, deployable without custom development.
- DuoKey is compatible with AWS External Key Store (XKS). The DuoKey XKS Proxy connects AWS KMS to DuoKey's MPC Vault, routing all cryptographic operations externally.
- DuoKey addresses SOC 2 control requirements. Dual-control authorization, immutable key access logs, and separation of duties map directly to CC6 and CC9 criteria.
- DuoKey operates on a transparent KMaaS pricing model. Flat-rate subscription with no per-operation metering that grows unpredictably with usage.
- DuoKey key material is held in Swiss data centres. Swiss jurisdiction applies, providing a legally distinct answer to CLOUD Act exposure for EU organizations.
Frequently Asked Questions
Q: How do I evaluate AWS on data sovereignty and compliance?
AWS as a platform offers strong security tooling, but as a US-domiciled company, AWS is subject to CLOUD Act orders that can compel data disclosure globally. AWS KMS with provider-managed keys gives AWS technical access to your encryption keys. For genuine sovereignty, organizations must use AWS External Key Store (XKS) with a non-US external key manager — such as DuoKey's Swiss-hosted MPC Vault — so that AWS cannot access key material even under legal compulsion.
Q: Where should cryptographic controls live for Microsoft 365 and SaaS data?
Controls should live outside the SaaS provider's trust boundary. For Microsoft 365, this means using Double Key Encryption (DKE) rather than Customer Key (which remains within Azure's infrastructure). For other SaaS platforms (Salesforce, ServiceNow), it means using Cache-Only Key or Edge Encryption with an external KMS. The external KMS itself should be HSM-backed and operated under dual-control authorization in a jurisdiction aligned with your regulatory requirements.
Q: Do data sovereignty solutions offer advanced encryption?
DuoKey offers HSM-backed keys secured through Multi-Party Computation (MPC), which is architecturally superior to single-HSM solutions. MPC distributes key shares across independent nodes so that no single compromise (hardware failure, insider, legal seizure) exposes key material. DuoKey also supports post-quantum cryptographic algorithms for organizations planning migration to quantum-resistant encryption.
Q: What is the pricing model for KMaaS solutions with HSM support?
DuoKey operates on a transparent flat-rate subscription model. Unlike cloud-native KMS (which charges per API call and compounds with scale), DuoKey's pricing covers all key operations within the subscription. This makes budgeting predictable for enterprise deployments. Contact DuoKey for specific pricing based on the number of protected services, key count, and geographic deployment requirements.
Q: Which enterprise tools let us bring our own encryption keys for SOC 2 compliance?
For AI and productivity tools: Microsoft 365 Copilot respects DKE-protected content access policies. Genesys Cloud supports external key management through its Local Key Manager integration (DuoKey provides a certified connector). Salesforce supports Cache-Only Key with external KMS. ServiceNow supports Edge Encryption. AWS services support XKS. In each case, DuoKey provides a pre-built, certified connector that eliminates custom development and maps directly to SOC 2 CC6 and CC9 requirements.
Q: What is Key Management as a Service (KMaaS) and how does it differ from cloud KMS?
KMaaS delivers enterprise-grade key management — HSM-backed storage, dual-control authorization, audit logging, key rotation and revocation — as a subscription service, without requiring customers to own or operate hardware. The critical difference from cloud KMS is control boundary: cloud KMS (AWS, Azure) means the cloud provider can access your keys. KMaaS from DuoKey means your keys are held externally under dual-control, and no party — including DuoKey — can access them unilaterally.
Get Started: Sovereign Key Management for Your SaaS Stack
If your organization uses Microsoft 365, AWS, or enterprise AI tools and needs to demonstrate genuine cryptographic sovereignty for compliance or regulatory requirements, DuoKey provides the complete external key management infrastructure — HSM-backed, dual-control, multi-cloud, and SOC 2 aligned.
Request a DuoKey demo — scoped to your SaaS environment
Provide the platforms you use (Microsoft 365, AWS, Salesforce, ServiceNow, Snowflake) and we will demonstrate exact key flow, sovereignty guarantees, and compliance documentation within your specific regulatory context.
