Microsoft Double Key Encryption (DKE)
Keep Microsoft from unlocking regulated mail, files and Teams content alone, without leaving M365.
Encrypt S3 objects
Client-side encryption for Amazon S3: objects are encrypted before they reach AWS, and decryption still needs a key share you hold outside AWS.
Client-side
Objects are encrypted before upload; S3 only stores ciphertext.
S3 scale stays
Keep S3 for durability and scale, without trusting it with the key.
Tracked
Every access to the key is logged with a full audit trail.
Encrypted before it leaves.
Unlike server-side encryption with AWS KMS, DuoKey client-side encryption seals objects before they are sent to S3.
- AWS infrastructure never sees the plaintext.
- Works with your existing buckets.
A key share outside AWS.
Keys are split with multi-party computation, and the share needed to decrypt stays outside AWS, in your tenant and vault.
- No single party, AWS included, holds a complete key.
- Dedicated tenant and vault for your keys.
No third party can read it.
Because AWS never holds the key, a provider-side access, request or breach yields ciphertext only.
- Supports GDPR and HIPAA requirements.
- Your keys, your decision.
Every access, tracked.
Logging and monitoring show who accessed encrypted data, when and with which key, with a detailed audit trail.
- Spot unusual access patterns.
- Evidence for compliance reviews.
Key features
Client-side encryption
Encryption always performed before upload.
MPC key management
No single point of failure or compromise.
No third-party access
AWS stores ciphertext only.
Dedicated tenant
A dedicated tenant and vault for your keys.
Usage monitoring
See who uses your keys.
Audit trail
Detailed logs for compliance.
Proof in practice
Where teams deploy this
Deep dives
Field guides for your programme
Trust
Assurance and customer programmes
Customer programmes
S3 storage. Your key.
See client-side encryption on your own buckets, with the key share outside AWS.
Products
Check out the other DuoKey products
View product