Skip to content
DekkoCORE

Keep the enclave sealed.Pass the work through the hatch.

DekkoCORE gives defence contractors a secure way to move material between a hardened internal environment and the suppliers, subcontractors and military clients outside it. Material leaves only into an end-to-end encrypted Hub that's IRAP assessed to PROTECTED, each outside party sees only what's shared with it, and every transfer is recorded, with no secure channel of your own to build and run.

Book a demo Read the ledger

Inside the enclave

  • vehicle_fleet_status.xlsx
  • engine_overhaul_procedure.pdf
  • spares_forecast_Q3.xlsx

Hatch

Outside

  • Parts supplierView only
  • Engine subcontractorDownload
  • Military clientView only, sign
Example Sustainment ServicesInner door open · Outer door locked

The problem

A sealed environment still has to talk to the outside.

Defence contractors build hardened internal environments to handle PROTECTED material. But the work involves suppliers, subcontractors and military clients who sit outside that environment, and the material has to reach them at the same level of protection.

Building and running a secure channel of your own for that means more infrastructure to stand up, patch and keep compliant, on top of the environment you already run.

The ledger

One piece of work, inside and out.

Follow an engine overhaul at Example Sustainment Services, a fictional sustainment contractor, from the enclave to the military client's sign-off.

  1. 01Choose what can leave

    Inside the enclaveThe engineering team picks the files the work needs and marks them, so every file that leaves carries its classification.

    OutsideNothing yet. Outside parties can't see the Hub until something is shared with them.

    • Markings required on every upload
    • Nothing shared by default

  2. 02Pass it through

    Inside the enclaveThe files go into the program's Hub from the browser or the Upload Accelerator, encrypted before they leave the device.

    OutsideThe engine subcontractor sees only its own folder, at the level you set, and can't see the other parties.

    • End-to-end encrypted
    • Seven permission levels
    • Outside parties can't see each other

  3. 03Work comes back

    Inside the enclaveYour team checks what came back and takes it in under your own procedures.

    OutsideThe subcontractor uploads its inspection reports into its folder. Every upload is scanned for malware as it arrives.

    • Uploads scanned over ICAP
    • No file size limits

  4. 04The client signs off

    Inside the enclaveThe contractor's program manager sends the report to the military client as a signature request.

    OutsideThe military client reads it View only and signs in the browser, after signing in.

    • Signature requests
    • View only in the secure viewer

  5. 05Every transfer is on the record

    Inside the enclaveYour security team exports the history of every file that left, and who opened it.

    OutsideOutside parties' access ends on the dates you set, or the moment you revoke it.

    • Audit logs as CSV or streamed to Log Analytics
    • Expiry dates and instant revocation

Protections

What your security officer will ask.

Assessed to PROTECTED
DekkoCORE is IRAP assessed for Australian government information up to PROTECTED, and hosted in Australia.
Zero-knowledge, end to end
Files are encrypted on the device that uploads them. DekkoSecure can't open them, and neither can anyone outside the share.
Hubs open only from where you allow
Region protection is an IP-based allow-list for every Hub, so you choose the networks it can be opened from.
Markings you can require
Require a classification marking on every upload and message, so nothing leaves unmarked.
Sign-in you can enforce
Two-factor authentication, passkeys with hardware attestation and single sign-on for everyone in the tenancy.
A channel you don't run
Encryption, key management and hosting are handled by the platform, so there's no self-managed channel to build, patch or maintain.

In the product

A DekkoCORE Hub's file list under an export controlled banner, with a classification, an owner and a version for each file
Marked on every fileClassification, version and owner sit beside every file in the Hub, under a banner your tenancy sets.
The DekkoCORE audit log listing document views, downloads and uploads with the user and date
Every transfer on the recordViews, downloads and uploads across the tenancy, ready to export for your security team.

Questions

Asked by defence security teams.

Does DekkoCORE connect directly to our enclave?

No connection is needed. Your team moves material from the enclave into a Hub under your own procedures, in the browser or with the Upload Accelerator. DekkoCORE handles the sharing outside.

What classification can it carry?

DekkoCORE is IRAP assessed for Australian government information up to PROTECTED, and hosted in Australia for Australian customers.

Can we limit where the Hub can be opened from?

Yes. Region protection is an IP-based allow-list for every Hub, so it opens only from the networks you approve, alongside sign-in.

Do our suppliers need their own secure environment?

No. They work in the browser after registering an account, and files are end-to-end encrypted, so there's nothing for them to install or run.

How do we show an auditor what left the enclave?

Every view, download and upload is logged against the file. Export tenancy-wide audit logs as CSV, or stream them to your Log Analytics workspace.

Keep the enclave. Lose the channel.

Show us how material leaves your environment today and who needs it outside. We'll show you the same work through a Hub, assessed to the same level.

Book a demo