Keep the key to customer records

Salesforce Shield Platform Encryption can use a key you control outside Salesforce. Your data stays useful in the CRM, without giving Salesforce the last key.

Key outside Salesforce

With the Cache-Only Key Service, Salesforce fetches the key on demand and never stores it.

CRM stays usable

Sales and service teams keep working; encryption happens inside Shield Platform Encryption.

Revocable

Withhold the key and Salesforce can no longer decrypt the protected fields and files.

Encrypted in Salesforce, keyed outside it.

Shield Platform Encryption protects fields and files at rest, and the key that unlocks them comes from DuoKey instead of being generated and stored by Salesforce.

Bring Your Own Key or the Cache-Only Key Service.
Supports GDPR, FINMA and HIPAA data protection programmes.

Cache-only: the key visits, then leaves.

Salesforce calls the DuoKey key service through a named credential, uses the key from an encrypted cache, and does not retain it.

Keys delivered in the JWE format Salesforce expects.
Cache lifetime bounded by Salesforce, then the key is fetched again.

Revoke, and the records go dark.

Stop serving the key and Salesforce cannot decrypt the protected data once its cache expires, an exit and incident lever you control.

No dependency on a Salesforce support ticket.
Restore access by serving the key again.

Every key request, on record.

Each callout from Salesforce is logged in the DuoKey journal, with keys held as MPC shards so no single party holds a complete key.

Evidence for auditors and data protection officers.
Same Cockpit as your Microsoft 365, AWS and database keys.

Sales Cloud

Service Cloud

Shield Platform Encryption

DuoKey for Salesforce

Named credential

Cache-Only Key Service

BYOK

Where it plugs into Salesforce.

DuoKey serves keys to Shield Platform Encryption, which encrypts data across the clouds you run on the Salesforce platform.

Set up through Salesforce Setup, a named credential and a key service URL.
Listed on Salesforce AppExchange.

Key features

Cache-Only Key Service

Key material served on demand, never stored by Salesforce.

BYOK

Generate and manage tenant secrets outside Salesforce.

MPC key management

Keys split across independent nodes, no single point of failure.

Revocation

Withhold the key to cut off decryption.

Audit trail

Every key request recorded with time and outcome.

One console

Salesforce keys next to your other cloud and SaaS keys.

Deploy it your way

Run the key service as a service or in your own infrastructure.

DuoKey Cloud

SaaS

The key service run by DuoKey, keys in your own tenant.

On-premises

Your infrastructure

Serve Salesforce keys from your own environment.

Implementation guide

Guide

BYOK vs cache-only, key format, set-up and revocation.

What is BYOK?

Explainer

Bring your own key, explained.

Financial services

Industry

Customer data in SaaS under FINMA and DORA.

Try it out

Free trial

Open a Cockpit tenant and serve a first key.

Proof in practice

Where teams deploy this

Financial Services

Secure Cloud Data Storage for Financial Services

Protect Customer Data and Ensure Compliance with DuoKey's Secure Cloud Storage for the Financial Industry

Read use case

Financial Services

Data Encryption for DORA Compliance

Meet DORA's requirements for encryption and key management with customer-controlled keys across cloud and SaaS.

Read use case

Deep dives

Field guides for your programme

Salesforce BYOK and Cache-Only Key Service: Secure Your CRM Data with External Key Management

Salesforce Shield BYOK vs the Cache-Only Key Service: JWE key format, 72-hour cache, revocation, setup steps and how DuoKey serves cache-only keys.

Read guide

What Is BYOK? Bring Your Own Key Encryption Explained

BYOK (bring your own key) lets you generate and control the keys a cloud service uses. How it works on Azure, AWS, Google and Microsoft 365. Limits.

Read guide

Compliance

Frameworks this product supports

DORA

ICT risk management and resilience for the EU financial sector, with encryption and keys you can prove you control.

Open framework

GDPR

Article 32 security, breach risk and transfers, encryption that is meaningful because you hold the keys.

Open framework

HIPAA

Technical safeguards for ePHI, encryption and key management you can stand behind in a BA audit.

Open framework

Trust

Assurance and customer programmes

ISO

ISO/IEC 27001:2022

Certified information security management system.

Security at DuoKey

Trust Center

Security and compliance documents for due diligence.

Open Trust Center

Customer programmes

Volkswagen · Automotive

OTA that stays under OEM authority.

DuoKey keeps PKI and signing with one of the world's leading automotive manufacturers, including at the edge, on the platforms already in production.

View case study

ICRC · Humanitarian

Beneficiary data sealed by keys the ICRC controls.

RedSafe, the ICRC's digital platform for people affected by conflict, encrypts beneficiary data with HashiCorp Vault. DuoKey auto-unseals Vault with an MPC-protected key under ICRC control, so no operator holds unseal keys and no hosting provider can open the data.

View case study

Swiss energy operator · Energy · Critical infrastructure

Board papers protected with a key Microsoft does not hold.

A Swiss critical-infrastructure operator in the energy sector uses DuoKey Double Key Encryption to keep its board's most sensitive documents in Microsoft 365, with the second key under its own control.

View case study

Major German bank · Banking

Microsoft 365 for a bank, with the key in the bank's hands.

A major German bank uses DuoKey Double Key Encryption to keep confidential client and internal data in Microsoft 365, while the second key stays outside Microsoft.

View case study

Swiss fintech bank · Banking · Digital assets

Blockchain transactions signed without a complete key ever existing.

A leading Swiss fintech bank secures its blockchain transactions with DuoKey MPC: signing keys are split into shares, and a transaction is signed only when policy and approvers agree.

View case study

Automotive manufacturer · Automotive · PKI

PKI and certificate lifecycle, automated end to end.

An automotive manufacturer uses DuoKey to run its PKI and automate the certificate lifecycle across IT, plants and connected services, so an expired certificate no longer stops the business.

View case study

OpenBAO Migration · Secrets management

Vault to OpenBAO Migration

Escape HashiCorp Vault Enterprise's per-token licensing and BSL vendor lock-in. Migrate to OpenBAO with DuoKey SD-HSM MPC auto-unseal and DuoKey Managed OpenBAO Service: same API, zero code changes and up to 60-80% lower TCO (estimate; depends on tokens, support and HSM estate).

View case study

Keep Salesforce useful. Keep the key.

See the Cache-Only Key Service with keys Salesforce never stores.

Request a demo Start a free trial

Products

Keep the key to customer records

Key outside Salesforce

CRM stays usable

Revocable

Encrypted in Salesforce, keyed outside it.

Cache-only: the key visits, then leaves.

Revoke, and the records go dark.

Every key request, on record.

Where it plugs into Salesforce.

Key features

Cache-Only Key Service

BYOK

MPC key management

Revocation

Audit trail

One console

Deploy it your way

DuoKey Cloud

On-premises

Implementation guide

What is BYOK?

Financial services

Try it out

Where teams deploy this

Secure Cloud Data Storage for Financial Services

Data Encryption for DORA Compliance

Field guides for your programme

Salesforce BYOK and Cache-Only Key Service: Secure Your CRM Data with External Key Management

What Is BYOK? Bring Your Own Key Encryption Explained

Frameworks this product supports

DORA

GDPR

HIPAA

Assurance and customer programmes

ISO/IEC 27001:2022

Trust Center

OTA that stays under OEM authority.

Beneficiary data sealed by keys the ICRC controls.

Board papers protected with a key Microsoft does not hold.

Microsoft 365 for a bank, with the key in the bank's hands.

Blockchain transactions signed without a complete key ever existing.

PKI and certificate lifecycle, automated end to end.

Vault to OpenBAO Migration

Keep Salesforce useful. Keep the key.

Related products

Microsoft Double Key Encryption (DKE)