Software · Cybersecurity

Encryption and key management

Encryption done properly: keys generated, stored, rotated and retired under control, with every use logged.

Encryption is only as strong as the way keys are handled, and a key pasted into a config file undoes it. We build key management services, secrets vaults and encryption libraries that keep keys in HSMs or cloud KMS, give applications short-lived access through simple APIs, and rotate keys without downtime. Every encrypt, decrypt and key change leaves an audit record.

What we build

Envelope encryption services that wrap data keys with master keys held in an HSM or KMS
Secrets vaults that issue short-lived database credentials and API tokens to applications
Field-level encryption and tokenisation for card numbers, ID numbers and health records
Key rotation jobs that re-wrap data keys without taking applications offline
Certificate lifecycle tooling that issues, renews and revokes TLS certificates automatically
Dual-control approval workflows for destroying or exporting sensitive keys

DemoInteractive · sample data

Try it live.

A working sample with made-up data. It runs in your browser; nothing is sent anywhere.

Key rotationsample data

sec@vault:~$ kmsctl status payments-mk
key: payments-mk  type: aes-256-gcm
version: 7  created: 2026-07-29
backend: hsm-cluster-a (PKCS#11)
next rotation due: 2026-10-27  policy: 90d
sec@vault:~$ kmsctl rotate payments-mk

What it does well

No keys in code

Applications ask the vault at runtime, so no key sits in a repository or config file.

Scheduled rotation

Keys rotate on a set cycle, and old versions stay available only for decryption.

Hardware-backed keys

Master keys stay inside HSMs or cloud KMS and are never exported in plain form.

Crypto agility

Algorithms are set in configuration, so moving to post-quantum schemes is a planned change.

Dual control

Destroying or exporting a key needs approval from two named people.

Usage audit

Each key operation is logged with the calling service, the key version and the result.

Questions

Do we need an HSM, or is cloud KMS enough?

Cloud KMS services from AWS, Azure and Google keep keys in hardware and suit most workloads. A dedicated HSM is worth it when regulation requires sole control of keys, when keys must stay on your premises, or for card PIN processing. We help you choose, with the requirements written down.

How do you rotate keys without breaking old data?

We use envelope encryption. Data is encrypted with data keys, which are wrapped by a master key. Rotating the master key means re-wrapping the small data keys, not re-encrypting every record, and old key versions stay available for decryption until nothing depends on them.

What about post-quantum cryptography?

We keep algorithm choices in configuration and record where each one is used. That makes it practical to adopt the NIST ML-KEM and ML-DSA standards, often in hybrid mode, as your libraries and platforms support them, starting with data that must stay secret for many years.

Services that go with it

Security hardeningServers, cloud accounts, devices and apps locked down against a recognised benchmark, with every change recorded.Security consultingAn independent view of your security weaknesses and a prioritised, practical plan to fix them.Custom software developmentSoftware designed and built around the way your business works, shown to you working at every review.

Related software

Identity and access managementWho can sign in, to what and why: single sign-on, MFA and access rules managed from one place.Compliance automationControls, evidence and policies kept current automatically, so an audit becomes a review, not a scramble.Fintech softwarePayment, lending and onboarding systems built for regulated money flows, with every movement traceable.Database systemsWell-designed, fast and recoverable databases for the applications and reports your business depends on.