A short check on how exposed your encryption keys are, and who could reach your data through a breach or legal demand.
The problem
July 2026
No human directed them
Source: OpenAI, The Hugging Face incident and the road ahead (opens in a new tab), 26 August 2026.
Most organisations encrypt their whole database with one key that rarely changes, a growing risk in the AI era.
Zero
developers can rotate their own encryption key on the database platform behind many AI-built applications.
64%
of leaked logins and access tokens found in 2022 were still working in January 2026.
1,823
secrecy orders in six months on a third of one provider’s US legal demands. The customer is never told it happened.
Sources: Supabase documentation; GitGuardian, State of Secrets Sprawl 2026; Microsoft, Government Requests for Customer Data, July to December 2025.
ScatterKey makes sure nobody ever holds the whole key, not even us.
How it works
Every item you protect gets its own key. We split it into three parts, keep them in three separate places, and change the key after every access.
No single breach yields a readable key, and the key changes after every access.
Not one key per platform. Not one per tenant. One for every item or line of content you protect.
Content is rekeyed on every usage cycle. There is no whole key at rest for anyone to steal, and an old key is a useless key.
Each key is split into three parts, held by your application, your user's app or device, and the key store. No single breach yields a readable key.
Key control sits outside the cloud platform and outside the application holding the data. No provider, in any jurisdiction, can produce plaintext it cannot read.
The vulnerable joint in a conventional stack is the key exchange, not the cipher. Ours is built so that joint does not exist.
ScatterKey makes sure nobody ever holds the whole key, not even us.
The proof
Why now
UK post-quantum deadlines, set by NCSC – GCHQ
Large organisations have to plan for this, and they will push the requirement down their supply chains. The security questionnaires your customers send you are about to grow a post-quantum section, and it will ask how your keys are managed, how often they rotate and who can reach them.
Most software vendors have no answer. We are the answer you can give.
Two ways to use it
Now onboarding our first builders and platforms
Plug-and-play subscription
For small and mid-size software builders. Self-serve: sign up and plug it in, with no sales call.
Free for up to 100 users or entities.
Then from £97 a month, with a 30-day trial.
Enterprise integration
For larger platforms. Our team integrates ScatterKey into your platform, and you then pay for use of our key store.
A one-off set-up fee, then a monthly fee per user or entity, however many records each one holds.
Either way, you pay per user or entity, not per record and not per key.
Where the boundary is
Distributed keys stop most real breaches, and most real sovereignty risk.
Next step
Start with the short check. If anything comes up, we are happy to help you work through it.