The master key is never stored ready for use
The key protecting your data is never stored whole in any location. It is reconstructed only at runtime in a deliberate unsealing ceremony and divided among trusted people.
hiVault — under development, coming soon
Sovereign secrets management for European businesses.
hiVault stores keys, passwords and certificates in encrypted form, protected by a master key that is never kept ready on the server, on infrastructure in the European Union and outside United States jurisdiction.
Outside United States jurisdiction
Infrastructure in Europe. Your secrets are not subject to United States data access laws. Sovereignty is an architectural decision, not a declaration.
Security from the ground up
Encryption at rest and in transit, least privilege and mutual authentication for connections. No error passes unnoticed.
Deliberate security
How hiVault protects your master key
Access to secrets requires people to work together. The server never holds everything it needs to decrypt the data on its own.
- 01
The master encryption key (MEK) is divided using Shamir's Secret Sharing. A defined threshold of shares is required; one share reveals nothing.
- 02
Each share is encrypted with a separate password and stored independently, outside the cloud.
- 03
Unsealing is a deliberate human ceremony, not an automatic read from a file.
- 04
After a restart, the server is sealed again. Data remains unavailable until authorised people unseal it.
Designed for accountable organisations
For organisations that know where convenience ends and control begins.
- Businesses with demanding security and data residency requirements.
- Financial institutions and organisations operating under strict compliance requirements.
- Development teams that need secrets management without dependence on United States providers.
Early access
Join the waitlist.
hiVault is currently under development. Leave your contact details and we will let you know about our progress and opportunities to take part in the first deployments.
MVP under development — access is not yet for sale.