Keep the key for Amazon S3

AWS services keep calling AWS KMS as usual, but every encrypt and decrypt under an XKS key also needs a key that stays outside AWS, with DuoKey.

Outside AWS

AWS KMS cannot create, view or use the external key without your key manager.

No application change

S3, EBS, RDS and your own code keep using AWS KMS key IDs.

Your kill switch

Disconnect the key store and AWS can no longer decrypt data under those keys.

AWS asks. Your key decides.

An AWS service calls AWS KMS, AWS KMS calls your XKS proxy, and the operation only completes with the external key held by DuoKey.

A custom key store backed by a key manager outside AWS.
Every request leaves a trace on both sides.

Four operations, signed.

The XKS proxy implements the AWS External Key Store Proxy API: GetHealthStatus, GetKeyMetadata, Encrypt and Decrypt, over HTTPS.

SigV4 authentication of every KMS-to-proxy request, over TLS 1.2 or later.
Two proxy credentials so you can rotate without downtime.

Disconnect, and the data goes dark.

Because AWS never holds the external key, disconnecting the key store or disabling the key stops AWS from decrypting the data it protects.

An exit plan regulators can test.
Availability of the key store becomes availability of the data: design for it.

Root key material split with MPC.

DuoKey generates and protects the external key with multi-party computation, so no single entity, AWS included, ever holds a complete key.

Dedicated tenant and vault for your keys.
Monitor who uses your keys and when.

AWS KMS

Amazon S3

Amazon EBS

DuoKey XKS

Amazon RDS

XKS proxy

AWS CloudTrail

One external key for your AWS estate.

Any AWS service that encrypts with a customer managed KMS key can use an XKS-backed key, while CloudTrail on the AWS side and the DuoKey journal on yours record each use.

Amazon S3, EBS and RDS, plus your own applications through the AWS SDK.
Plan for the extra network round trip on high-volume workloads.

Key features

AWS XKS proxy

The four proxy operations, SigV4-authenticated, over HTTPS.

MPC key material

External keys generated and used without a single complete copy.

Client-side control

Encryption and decryption under keys you hold, outside AWS.

Dedicated tenant

A dedicated tenant and vault for your keys.

Usage monitoring

See who uses which key, from where and when.

Health status

Proxy and key manager health reported to AWS KMS.

Deploy XKS your way

Run the external key store as a service or in your own infrastructure.

DuoKey Cloud

SaaS

The XKS proxy and key nodes run by DuoKey, outside AWS.

On-premises

Your data centre

Proxy and key nodes in your own environment.

Implementation guide

Guide

Set-up, proxy API and error codes, step by step.

XKS vs CloudHSM key store

Guide

Which custom key store fits your requirement.

Data sovereignty

Use case

Keep the authority to decrypt in your jurisdiction.

Try it out

Free trial

Open a Cockpit tenant and connect a first key store.

Proof in practice

Where teams deploy this

Financial Services

Secure Cloud Data Storage for Financial Services

Protect Customer Data and Ensure Compliance with DuoKey's Secure Cloud Storage for the Financial Industry

Read use case

Financial Services

Data Encryption for DORA Compliance

Meet DORA's requirements for encryption and key management with customer-controlled keys across cloud and SaaS.

Read use case

Deep dives

Field guides for your programme

AWS KMS Custom Key Store: CloudHSM Key Store and External Key Store (XKS)

An AWS KMS custom key store is either a CloudHSM key store or an external key store (XKS). Where the key material sits, who operates it, and when XKS is the one you need.

Read guide

AWS External Key Store (XKS): Complete Implementation Guide 2026

How the AWS KMS External Key Store (XKS) works: proxy setup with CLI steps, the 250 ms and 35 ms limits, error codes, and when XKS beats CloudHSM.

Read guide

Hold Your Own Key (HYOK): How It Works, BYOK vs HYOK, and Where It Applies (2026)

Hold your own key (HYOK) explained: BYOK vs HYOK vs provider-managed keys, how Microsoft 365 DKE, AWS XKS and Google CSE implement it, and how to choose.

Read guide

Customer-Controlled Encryption Keys: AWS XKS, Office 365 Customer Key & Complete Data Control

Discover what Customer-Controlled Encryption keys are and why your organisation need them

Read guide

Compliance

Frameworks this product supports

DORA

ICT risk management and resilience for the EU financial sector, with encryption and keys you can prove you control.

Open framework

GDPR

Article 32 security, breach risk and transfers, encryption that is meaningful because you hold the keys.

Open framework

NIS2

Network and information security for essential and important entities, encryption and keys you govern, not just a checkbox.

Open framework

Trust

Assurance and customer programmes

ISO

ISO/IEC 27001:2022

Certified information security management system.

Security at DuoKey

Trust Center

Security and compliance documents for due diligence.

Open Trust Center

Customer programmes

Volkswagen · Automotive

OTA that stays under OEM authority.

DuoKey keeps PKI and signing with one of the world's leading automotive manufacturers, including at the edge, on the platforms already in production.

View case study

ICRC · Humanitarian

Beneficiary data sealed by keys the ICRC controls.

RedSafe, the ICRC's digital platform for people affected by conflict, encrypts beneficiary data with HashiCorp Vault. DuoKey auto-unseals Vault with an MPC-protected key under ICRC control, so no operator holds unseal keys and no hosting provider can open the data.

View case study

Swiss energy operator · Energy · Critical infrastructure

Board papers protected with a key Microsoft does not hold.

A Swiss critical-infrastructure operator in the energy sector uses DuoKey Double Key Encryption to keep its board's most sensitive documents in Microsoft 365, with the second key under its own control.

View case study

Major German bank · Banking

Microsoft 365 for a bank, with the key in the bank's hands.

A major German bank uses DuoKey Double Key Encryption to keep confidential client and internal data in Microsoft 365, while the second key stays outside Microsoft.

View case study

Swiss fintech bank · Banking · Digital assets

Blockchain transactions signed without a complete key ever existing.

A leading Swiss fintech bank secures its blockchain transactions with DuoKey MPC: signing keys are split into shares, and a transaction is signed only when policy and approvers agree.

View case study

Automotive manufacturer · Automotive · PKI

PKI and certificate lifecycle, automated end to end.

An automotive manufacturer uses DuoKey to run its PKI and automate the certificate lifecycle across IT, plants and connected services, so an expired certificate no longer stops the business.

View case study

OpenBAO Migration · Secrets management

Vault to OpenBAO Migration

Escape HashiCorp Vault Enterprise's per-token licensing and BSL vendor lock-in. Migrate to OpenBAO with DuoKey SD-HSM MPC auto-unseal and DuoKey Managed OpenBAO Service: same API, zero code changes and up to 60-80% lower TCO (estimate; depends on tokens, support and HSM estate).

View case study

Keep using AWS. Keep the key.

See an XKS-backed key protect S3 and EBS in your own AWS account.

Request a demo Start a free trial

Products

Keep the key for Amazon S3

Outside AWS

No application change

Your kill switch

AWS asks. Your key decides.

Four operations, signed.

Disconnect, and the data goes dark.

Root key material split with MPC.

One external key for your AWS estate.

Key features

AWS XKS proxy

MPC key material

Client-side control

Dedicated tenant

Usage monitoring

Health status

Deploy XKS your way

DuoKey Cloud

On-premises

Implementation guide

XKS vs CloudHSM key store

Data sovereignty

Try it out

Where teams deploy this

Secure Cloud Data Storage for Financial Services

Data Encryption for DORA Compliance

Field guides for your programme

AWS KMS Custom Key Store: CloudHSM Key Store and External Key Store (XKS)

AWS External Key Store (XKS): Complete Implementation Guide 2026

Hold Your Own Key (HYOK): How It Works, BYOK vs HYOK, and Where It Applies (2026)

Customer-Controlled Encryption Keys: AWS XKS, Office 365 Customer Key & Complete Data Control

Frameworks this product supports

DORA

GDPR

NIS2

Assurance and customer programmes

ISO/IEC 27001:2022

Trust Center

OTA that stays under OEM authority.

Beneficiary data sealed by keys the ICRC controls.

Board papers protected with a key Microsoft does not hold.

Microsoft 365 for a bank, with the key in the bank's hands.

Blockchain transactions signed without a complete key ever existing.

PKI and certificate lifecycle, automated end to end.

Vault to OpenBAO Migration

Keep using AWS. Keep the key.

Other Encryption Key Management Solutions

Microsoft Double Key Encryption (DKE)