DuoKey vs Thales

124/7 support with SLA response times

Round-the-clock support with contractual response times for critical incidents.

2Evaluation or trial licence

A free trial or proof-of-concept licence to test before buying.

3Native Microsoft 365 DKE endpoint

Serves the Microsoft GetKey and Decrypt calls used by Word, Excel, PowerPoint and Outlook.

4Decrypt authorized by Entra ID groups

The key service itself restricts decryption to members of directory groups or roles.

5Multi-tenant and partner (B2B) tenants

One key service shared with several Entra ID tenants or external partners.

6Admin SSO and MFA

Administrators sign in through the corporate identity provider with multi-factor authentication.

7Fine-grained administrator RBAC

Custom roles and permissions scoped to keys, services or organisational units.

8Quorum (four-eyes) approval

Sensitive key operations need approval from several administrators.

9Contextual access on key use

Decrypt allowed or denied by IP range, country or time of day.

10Audit logs exported to a SIEM

Key and admin events forwarded to Splunk, Sentinel, QRadar or syslog.

11Built-in monitoring dashboard

Health and usage dashboard shipped with the product.

12SNMP monitoring

SNMP polling or traps for the operations team.

28Access rules changed live

DKE access rules are edited in a UI or API and apply at once, without config files or redeployment.

29Block rules that override allows

Explicit deny rules to cut decrypt access for a user, group, network or country during an incident.

30Several identity providers

Entra ID plus Okta, Keycloak or other OIDC providers for sign-in and group-based rules.

31Tamper-evident audit log

Each audit record is signed or hash-chained, so edits and deletions are detectable.

32Optional mTLS on decrypt calls

A client-certificate check on DKE decrypt calls, on top of the Entra ID token.

33Built-in end-to-end key test

The key and backend are tested with a wrap/unwrap round-trip before the service goes live.

13High-availability cluster

Active-active nodes so the key service survives a node failure.

14Multi-site or geo-redundant deployment

Survives the loss of a whole data centre.

15Key backup and recovery procedure

Documented backup and restore of keys after an incident.

16Old documents open after rotation

Content protected with a previous key version stays readable.

17Rotation without a new Purview label

Rotating the key does not require a new label or a relabelling campaign.

18Scheduled key rotation

Automatic rotation on a schedule.

19Vendor-hosted DKE service (SaaS)

The vendor runs the DKE endpoint; nothing for the customer to host.

20On-premises option

Run the whole DKE stack inside your own perimeter.

21Automatic Entra ID app registration

The DKE app registration is created for you instead of manual portal steps.

22No end-of-life runtime or OS

The documented deployment does not depend on an unsupported framework or operating system.

23FIPS 140 Level 3 key storage

Keys protected by a FIPS 140-2 or 140-3 Level 3 validated module.

24Key never assembled in one place

Multi-Party Computation or threshold cryptography: no single node holds the whole key.

25Vendor ISO/IEC 27001 certified

The vendor's own operations are ISO/IEC 27001 certified.

26Customer chooses the hosting region

Pick where the key service and keys are hosted.

27Key export in standard formats

Reversibility: keys can be exported through KMIP, PKCS#8 or PKCS#12.