Keep the Vault API

OpenBao keeps 100% compatibility with the HashiCorp Vault API, and DuoKey SD-HSM replaces HSM hardware for auto-unseal and seal wrap, with keys that never exist in plaintext.

Zero code changes

Applications only need a new vault address. Same API, same clients.

No HSM to buy

MPC auto-unseal and seal wrap instead of hardware appliances.

No per-token licensing

OpenBao is MPL 2.0 under Linux Foundation governance, with flat-fee managed operations.

Same API. A new address.

OpenBao is a community fork of HashiCorp Vault with the same API, so applications, CLIs and integrations keep working after a vault address change.

Proven 2 to 4 week migration path with zero downtime.
Open source under MPL 2.0, not BSL.

Auto-unseal without a single key holder.

The master key that unseals the vault is protected with multi-party computation, so no operator, file or single node holds it.

Auto-unseal through PKCS#11 with DuoKey SD-HSM.
Solves the chicken-and-egg problem of secrets management.

Seal wrap for the most sensitive values.

Seal wrap adds a second layer of protection to critical values in the storage backend, using the same MPC-protected key.

Keys never exist in plaintext, not even in memory.
Complete audit trail of key operations.

Operated with you, 24/7.

DuoKey and its partners run enterprise operations around the clock: monitoring, upgrades and incident response, EU-hosted.

TISAX, ISO 27001 and GDPR-ready operations.
In production for the ICRC RedSafe platform.

Kubernetes

CI/CD pipelines

Cloud workloads

OpenBao + DuoKey

Applications

PKCS#11 auto-unseal

Audit trail

Secrets management that fits your stack.

OpenBao serves the same secrets engines and auth methods your teams already use, with the master key under DuoKey MPC protection.

Kubernetes, CI/CD pipelines and cloud workloads.
Migration tooling from HashiCorp Vault Enterprise.

Key features

100% Vault API compatible

Applications only change the vault address.

MPC auto-unseal

No HSM hardware, no master key on disk.

Seal wrap

A second layer of protection on critical values.

Managed operations

24/7 monitoring, upgrades and incident response.

Proven migration

2 to 4 weeks from Vault Enterprise, with zero downtime.

Open source

MPL 2.0 under Linux Foundation governance.

Move off Vault Enterprise your way

Run OpenBao yourself with DuoKey auto-unseal, or let DuoKey and its partners operate it.

Managed

EU-hosted

OpenBao and SD-HSM operated 24/7 by DuoKey partners.

Self-hosted

Your clusters

Run OpenBao yourself with DuoKey MPC auto-unseal.

Migration

From Vault Enterprise

The migration path, step by step.

BSL change

Explainer

What the Vault licence change means for you.

Customer story

ICRC

Vault auto-unseal with an MPC key under ICRC control.

Secrets management

Use case

The chicken-and-egg problem, solved.

Proof in practice

Where teams deploy this

Infrastructure

Secrets Management

Externalize your vault's master key to MPC or HSM and solve the chicken-and-egg problem of secrets management.

Read use case

Cloud Security

Sovereign Cloud

Achieve data sovereignty, ensure compliance in any cloud and maintain data control across borders

Read use case

Deep dives

Field guides for your programme

HashiCorp Vault Alternatives: OpenBao, Cloud Secret Managers and Where DuoKey Fits

Compare HashiCorp Vault alternatives: OpenBao, AWS, Azure and Google secret managers, Conjur and Infisical. See what changes for your apps and unseal keys.

Read guide

HashiCorp Vault and BSL 1.1: What It Means and What to Do About It

Plan a Vault-to-OpenBao migration after HashiCorp BSL: keep the API, cut licensing cost and protect unseal keys with customer-held MPC.

Read guide

OpenBao Auto-Unseal: Seal Options Compared and PKCS#11 Setup with DuoKey (2026)

How OpenBao auto-unseal works, which seal to pick (cloud KMS, Transit, static key, PKCS#11 HSM) and a step-by-step PKCS#11 setup, Kubernetes included.

Read guide

Vault Auto-Unseal with an HSM: How the PKCS#11 Seal Works and How to Set It Up

How HashiCorp Vault auto-unseal with an HSM works: the PKCS#11 seal, Enterprise requirement, recovery keys, seal wrap, and an HSM-free option using MPC.

Read guide

MPC vs HSM: Which Key Management Approach Secures Your Enterprise?

MPC vs HSM for key management: where the key lives, single points of failure, latency, certification, cost drivers and when to choose each or both.

Read guide

Compliance

Frameworks this product supports

DORA

ICT risk management and resilience for the EU financial sector, with encryption and keys you can prove you control.

Open framework

ISO 27001

International standard for information security management systems. DuoKey is ISO/IEC 27001 certified.

Open framework

NIS2

Network and information security for essential and important entities, encryption and keys you govern, not just a checkbox.

Open framework

Trust

Assurance and customer programmes

ISO

ISO/IEC 27001:2022

Certified information security management system.

Security at DuoKey

Trust Center

Security and compliance documents for due diligence.

Open Trust Center

Customer programmes

Volkswagen · Automotive

OTA that stays under OEM authority.

DuoKey keeps PKI and signing with one of the world's leading automotive manufacturers, including at the edge, on the platforms already in production.

View case study

ICRC · Humanitarian

Beneficiary data sealed by keys the ICRC controls.

RedSafe, the ICRC's digital platform for people affected by conflict, encrypts beneficiary data with HashiCorp Vault. DuoKey auto-unseals Vault with an MPC-protected key under ICRC control, so no operator holds unseal keys and no hosting provider can open the data.

View case study

Swiss energy operator · Energy · Critical infrastructure

Board papers protected with a key Microsoft does not hold.

A Swiss critical-infrastructure operator in the energy sector uses DuoKey Double Key Encryption to keep its board's most sensitive documents in Microsoft 365, with the second key under its own control.

View case study

Major German bank · Banking

Microsoft 365 for a bank, with the key in the bank's hands.

A major German bank uses DuoKey Double Key Encryption to keep confidential client and internal data in Microsoft 365, while the second key stays outside Microsoft.

View case study

Swiss fintech bank · Banking · Digital assets

Blockchain transactions signed without a complete key ever existing.

A leading Swiss fintech bank secures its blockchain transactions with DuoKey MPC: signing keys are split into shares, and a transaction is signed only when policy and approvers agree.

View case study

Automotive manufacturer · Automotive · PKI

PKI and certificate lifecycle, automated end to end.

An automotive manufacturer uses DuoKey to run its PKI and automate the certificate lifecycle across IT, plants and connected services, so an expired certificate no longer stops the business.

View case study

OpenBAO Migration · Secrets management

Vault to OpenBAO Migration

Escape HashiCorp Vault Enterprise's per-token licensing and BSL vendor lock-in. Migrate to OpenBAO with DuoKey SD-HSM MPC auto-unseal and DuoKey Managed OpenBAO Service: same API, zero code changes and up to 60-80% lower TCO (estimate; depends on tokens, support and HSM estate).

View case study

Keep the Vault API. Drop the lock-in.

Plan your move to OpenBao with MPC auto-unseal and managed operations.

Request a demo Read the migration guide

Products

Keep the Vault API

Zero code changes

No HSM to buy

No per-token licensing

Same API. A new address.

Auto-unseal without a single key holder.

Seal wrap for the most sensitive values.

Operated with you, 24/7.

Secrets management that fits your stack.

Key features

100% Vault API compatible

MPC auto-unseal

Seal wrap

Managed operations

Proven migration

Open source

Move off Vault Enterprise your way

Managed

Self-hosted

Migration

BSL change

Customer story

Secrets management

Where teams deploy this

Secrets Management

Sovereign Cloud

Field guides for your programme

HashiCorp Vault Alternatives: OpenBao, Cloud Secret Managers and Where DuoKey Fits

HashiCorp Vault and BSL 1.1: What It Means and What to Do About It

OpenBao Auto-Unseal: Seal Options Compared and PKCS#11 Setup with DuoKey (2026)

Vault Auto-Unseal with an HSM: How the PKCS#11 Seal Works and How to Set It Up

MPC vs HSM: Which Key Management Approach Secures Your Enterprise?

Frameworks this product supports

DORA

ISO 27001

NIS2

Assurance and customer programmes

ISO/IEC 27001:2022

Trust Center

OTA that stays under OEM authority.

Beneficiary data sealed by keys the ICRC controls.

Board papers protected with a key Microsoft does not hold.

Microsoft 365 for a bank, with the key in the bank's hands.

Blockchain transactions signed without a complete key ever existing.

PKI and certificate lifecycle, automated end to end.

Vault to OpenBAO Migration

Keep the Vault API. Drop the lock-in.

Related products

Microsoft Double Key Encryption (DKE)