Encryption keys
Protect content confidentiality. File encryption and key wrapping keep encrypted data separate from its usable decryption keys.
Security & Architecture
Technical assurance for verifiable communication
We Secure Data SaaS
We Secure Data SaaS is hosted and operated by We Secure Data. Messages and files are encrypted in the browser before storage, with organisation boundaries, identity-based access, audit records and cryptographic provenance built into the workflow.
Starter, Professional and Business customers use the managed SaaS service without provisioning their own cloud project, KMS or dedicated infrastructure.
DISTINCT KEYS. DISTINCT SECURITY PURPOSES.
Company-specific provenance keys
Each company’s supported message and file provenance is signed under its own key, rather than a provenance key shared across tenants. In hosted SaaS, authorised We Secure Data services invoke company-specific ECDSA signing keys in managed Cloud KMS. Company ownership checks select the right key; cloud access controls protect signing operations.
The private signing component stays in the managed key service. This operational model is separate from customer-held offline recovery keys.
Provenance signing keys
Create verifiable signatures over covered evidence and file fingerprints. Public keys enable integrity and key-based origin checks.
Recovery keys
Unlock applicable encrypted backup packages. Customer-controlled recovery uses a separately held private recovery key and password.
These keys are not interchangeable. Deployment-wide public audit anchors also have a separate signing context.
How company signing keys are protected and verified →BUSINESS CONTINUITY · YOUR OWN RECOVERY
Recovery that doesn't depend on your SaaS provider.
Keep a recoverable copy of your business information under your own control. Business includes Independent Backup & Offline Recovery: encrypted packages you can retain and open on your own Windows or Mac computer, independently of We Secure Data’s hosted availability.
Explore Independent RecoveryYour complete offline recovery kit
Save the complete downloaded package, its verification key and Recovery Desktop. Keep the matching private recovery key and password securely under your control, together with any additional customer-exclusive keys needed by particular files.
Recover supported customer files and associated catalogue information locally. Your downloaded archive has its own retention; the hosted recovery window is 14 days.
Client-side encryption
Messages and files are encrypted before upload, reducing readable-data exposure inside vendor infrastructure.
Organisation separation
Identity-based access and organisation security boundaries keep each tenant’s users and content separated within the hosted service.
Access, audit and provenance
Controlled external access, audit context and cryptographic provenance help teams verify the recorded sender identity and whether a document changed.
Threat model
What We Secure Data is designed to reduce.
Designed to protect against
Vendor breach exposing readable customer data.
Unauthorised direct access to encrypted content in storage.
SaaS central breach target risk.
Storage compromise where attackers obtain encrypted blobs only.
Not designed to replace
Endpoint security for compromised user devices.
Strong identity controls for stolen user credentials.
Good internal access governance, approvals, and user lifecycle management.
Implementation-backed cryptography
Browser encryption and independently reproducible evidence checks.
Files use AES-256-GCM with fresh per-file data-encryption keys, authenticated chunk metadata and KMS key wrapping. Separate ECDSA P-256 keys sign canonical provenance evidence and public audit anchors.
A trusted public key must first be obtained from the authenticated We Secure Data key endpoint or another trusted source.
Read the Cryptographic ProtocolLAYERED BUSINESS SECURITY
Protect access. Check the evidence.
Encryption protects confidentiality. Access controls limit who can retrieve protected content. Cryptographic provenance lets a recipient check signed content and recorded origin. Together, these controls give your team confidentiality, controlled access and checkable evidence of what was shared.
Read the guide to AI business impersonation →Separate deployment model
We Secure Data Dedicated Deployment
Need your own infrastructure?
Organisations that want their own environment can purchase a turnkey dedicated deployment. We Secure Data prepares the agreed environment, ready for the customer to take ownership. The scope can include dedicated infrastructure, customer-controlled KMS and IAM, and an organisation-specific domain and branding.
This is a premium alternative to SaaS, not a prerequisite for using We Secure Data.
Different controls solve different problems.
Recipient access checks control retrieval; retraction withdraws future external access. Encryption protects content. Provenance checks recorded origin and file integrity. Hosted permission scoping and a separately provisioned dedicated environment are different isolation arrangements. These measures support your policies; they are not a guarantee against all fraud or a compliance certification.
Connect the rest of the workflow.
The power to take it back.
Sent something sensitive to the wrong person? Withdraw future external access to the protected message and its files.
Explore the capability →Keep recovery in your own hands.
Separate customer-controlled recovery from everyday access control, and understand who owns the keys and responsibilities in your deployment.
Explore the capability →Keep the right people in control.
Manage users, roles, shared workspaces and communication settings around the way your organisation works.
Explore the capability →