Swiss energy operator case study

The problem

The board works in Microsoft 365 like the rest of the company. Strategy, grid security and regulatory files are critical-infrastructure information. With standard cloud encryption the provider can still decrypt them, including in response to a foreign legal request.

How DuoKey helps

DuoKey adds a second key held outside Microsoft. Board content labelled for Double Key Encryption opens in Word, Excel, PowerPoint and Outlook for authorised members, and stays unreadable to the cloud provider.

How it works

Step by step, where the keys go

01 / 04
The board label is applied
A board paper in Word, Excel or PowerPoint gets the dedicated board sensitivity label. Nothing else changes for the author.
02 / 04
Two keys lock the document
The content is encrypted with a Microsoft key and a second key held by DuoKey for the operator. Both are needed to open it.
03 / 04
An authorised member opens it
For a board member, both keys are released and the document opens in the usual Office app. DuoKey records the key request.
04 / 04
The provider alone cannot
Microsoft, or anyone presenting a legal request to Microsoft, holds only the first key. The document stays locked and the refusal is on record.

Security leadership

The questions this programme had to answer

What changed

How DuoKey protects board information in Microsoft 365

DKE
Second key outside the cloud
Protected board documents need a key that Microsoft never holds.
Board
Protection scoped to the people who need it
A dedicated sensitivity label covers board material without changing how the rest of the company works.
M365
The board keeps its tools
Members read and edit protected files in the Office apps they already use.
Proof
Key use recorded independently
Every decryption request is logged by DuoKey, outside Microsoft's own audit trail.

More programmes

Volkswagen

OTA that stays under OEM authority.

View case study

ICRC

Beneficiary data sealed by keys the ICRC controls.

View case study

Major German bank

Microsoft 365 for a bank, with the key in the bank's hands.

View case study

Swiss fintech bank

Blockchain transactions signed without a complete key ever existing.