Encryptedby design.
DekkoSecure's collaboration platforms are built for agencies and organisations that need confidentiality, integrity and strict control over where their data lives.
The same security foundations protect both products:
and
Encryption on the user's device
AES-256
for content
ECC-384
for user key pairs
Post-quantum cryptographyComing soon
End-to-end encryption
All content is end-to-end encrypted, including files, messages, signatures and video meetings. Encryption happens on the user's device, and decryption keys never leave the customer's control, so encrypted material is never visible to DekkoSecure staff or the underlying cloud providers.
Zero-knowledge security model
Content stays encrypted through upload, storage and review, so neither platform staff nor cloud providers can view customer data in plaintext. That removes insider-access risk and keeps work confidential across agencies and organisations.
We built a vault we can't open.
Encrypted before upload
Files are never sent or stored in readable form.
plaintext → ciphertextSealed in transit and at rest
Servers in your chosen country hold only ciphertext.
ciphertextKeys handled automatically
Users never see or manage them. DekkoSecure never has one.
zero-knowledgeOpened by the recipient only
Files are decrypted on their device as they open them.
ciphertext → plaintextWhat you see
Brief to counsel
Matter 24/1187 · Privileged and confidential
1. Summary of evidence
The attached material comprises 14 exhibits, including body-worn video, a forensic image of the device seized on 12 March, and three witness statements.
2. Recommendation
Proceed on counts 1 and 3. Further disclosure is required before the committal hearing.
Secure fromthe first login.
Both platforms are Secure by Design. Encryption enforcement, MFA, access governance, audit logging and hardened infrastructure are applied automatically, with no complex configuration, and stay in force throughout every collaboration and evidence workflow.
Sovereign hosting and data residency.
Hosted in sovereign environments, with all encrypted data and metadata kept in the chosen country.
- Australia
- Canada
- United States
Hosted only in the United States, in line with justice-sector expectations for evidence handling and disclosure.
- United States
Security that doesn't ask you to trust anyone.
Zero-knowledge
Only your recipients can read it.
Not even DekkoSecure can open your files.
See how : Zero-knowledgeAI-resistant
Built for the age of AI attackers.
AI makes attacks faster. It still can't read end-to-end encrypted files.
See how : AI-resistantInvisible
Security nobody has to think about.
Invite, create an account, collaborate. Encryption is automatic.
See how : Invisible
Hardened infrastructure, isolated tenancies.
Hardened cloud infrastructure
DekkoCORE and DekkoDEMS run on a hybrid architecture across Microsoft Azure and Oracle Cloud Infrastructure. Both provide advanced physical security, network isolation, continuous monitoring and protection against intrusion.
Multi-tenant isolation
Per-user and per-file cryptographic separation keeps each organisation's encrypted data isolated from every other, and platform administrators can't view or decrypt customer content. You get the benefits of a multi-tenant platform with end-to-end encryption and zero-knowledge protection.
Where private cloud and BYOK fall short.
- Complex and expensiveThey need dedicated infrastructure, HSMs and specialist staff.
- A central key is a central targetWhoever reaches the key store can unlock everything.
- Hard to manageRotation, backup and availability fall on your team.
- End users pay the priceExtra steps push people back to email.
- Single-tenant by designEvery partner needs an account in every tenancy.
The DekkoSecure answer
One multi-tenant, zero-knowledge platform that everyone shares securely.
Who manages the keys
DekkoSecure: DekkoSecure does it automatically on users' devices
Private cloud / BYOK / HSM: IT, centrally, often in an HSM
What it takes to run
DekkoSecure: Nothing extra to deploy
Private cloud / BYOK / HSM: Dedicated infrastructure and specialists
Working with other organisations
DekkoSecure: One account across the network
Private cloud / BYOK / HSM: A new account in every tenancy
End-user experience
DekkoSecure: No extra steps for users
Private cloud / BYOK / HSM: Extra steps and workarounds
Who can read stored files
DekkoSecure: Only the people you share with
Private cloud / BYOK / HSM: Anyone who can reach the keys
| Comparison | Private cloud / BYOK / HSM | DekkoSecure |
|---|---|---|
| Who manages the keys | IT, centrally, often in an HSM | DekkoSecure does it automatically on users' devices |
| What it takes to run | Dedicated infrastructure and specialists | Nothing extra to deploy |
| Working with other organisations | A new account in every tenancy | One account across the network |
| End-user experience | Extra steps and workarounds | No extra steps for users |
| Who can read stored files | Anyone who can reach the keys | Only the people you share with |
Who gets in,what they can do,and what they did.
Authentication and identity
Single sign-on integrates with Microsoft Entra ID and other enterprise and government identity providers, with support for strong authentication and conditional access policies. Users without SSO sign in with a passkey or TOTP-based MFA, and administrators can require hardware security keys. Identity controls apply the same way across DekkoCORE and DekkoDEMS.
Access control and authorisation
Role-based access applies consistently across collaboration spaces, cases and evidence items. Permissions can be set for individuals, groups or external partners, so people see only what they're authorised to. DekkoDEMS adds controls for case attribution and chain of custody.
Immutable audit logging
Collaboration, administrative and evidence-handling actions are recorded in a tamper-evident audit trail, giving investigators, administrators and prosecutors the visibility they need for chain-of-custody verification, compliance assessments and court proceedings. Audit events can also stream into your Azure Log Analytics workspace, so your security team can monitor them alongside the rest of your environment.
Tested independently. Watched continuously.
Independent testing and assurance
Regular independent penetration testing and security assessments validate the platform, backed by continuous monitoring, vulnerability management and secure development practices.
Operational security and monitoring
Access to operational systems is least-privilege, personnel are vetted and infrastructure is monitored continuously. Customer environments are isolated with region-specific controls, and no operational staff have access to encrypted content.
Talk to us about security.
If you'd like to learn more about DekkoSecure's compliance status or discuss your requirements, our team is ready to help.