Book a call
CLOUD Act exposure assessment

Who can reach your encryption keys?

A fixed-fee CLOUD Act exposure assessment for UK and EU banks and insurers.

Book a 30-minute call How it works

The key decides, not the server

A UK region tells you where a server stands. It does not tell you which companies can be ordered to act.

Key held by the provider

Key held by the provider A foreign court order served on the cloud provider reaches both your data and your key, so readable data can be handed over. Foreign court order Cloud provider Data Key Readable data handed over
One demand on the provider can reach both the data and the key.

Key held under your control in the UK

Key held under your control in the UK The same court order served on the cloud provider reaches only scrambled data, because the key sits in a UK key store under your control. Foreign court order Cloud provider Scrambled data Your key store UK, your control Scrambled data only
The same demand reaches the provider, which holds nothing it can unscramble.

Three steps to control your keys

Find out who can reach your keys

A fixed-fee written assessment shows who generates, stores and can use each key, and which companies could be ordered to produce it.

Move the keys into your control

Your master keys move into certified hardware you control. The provider must call a service you control before it can decrypt.

Prove it every month

Managed key custody gives you a monthly report of every operation requested on your keys, by whom and when.

See how it works

Why firms are asking now

  • 18 March 2027The PRA's updated outsourcing expectations take effect for UK banks and insurers.
  • Key managementThe PRA expects firms to weigh legal and political risk to their data, and names key management as a control.
  • EU operationsDORA contracts must name where data is processed and stored.

Know the answer in four weeks

Fixed fee, fixed scope, and a written report your board can use.

Book a 30-minute call