Product

VeraUno provides the core components organisations need to run true client-side encryption with real control over their data.

What we offer

1. KACLS (Key Access Control List Service) Our managed Key Access Control List Service is the heart of the system. It controls access to the encryption keys used for client-side encrypted content.

2. Optional Email Client A dedicated mail client that encrypts and decrypts messages on the user’s device. It works with your existing mail servers and can be used alongside or instead of Gmail. The client can be hosted by us or deployed in-house for larger enterprise clients.

3. Management Portal A complete backend portal that lets administrators manage the KACLS, users, access policies, logging, and key operations from a single interface.

Together these components give organisations cryptographic control over their most sensitive communications and documents.

What is a KACLS?

KACLS stands for Key Access Control List Service.

It is an external service that decides who is allowed to access the encryption keys used in client-side encryption.

Here’s how it works:

1. When a user creates or opens encrypted content, the application generates a temporary Data Encryption Key (DEK).
2. That DEK is sent to the KACLS.
3. The KACLS checks whether the user is authorised according to the organisation’s policies.
4. If authorised, the KACLS wraps (encrypts) or unwraps (decrypts) the DEK and returns it.
5. The content is then encrypted or decrypted on the user’s device.

The email or file provider (Google, Microsoft, or others) only ever sees ciphertext and a wrapped key. They never receive the raw key that can unlock the content.

Why do Google, Microsoft and other providers need an independent external KACLS?

Major email and collaboration platforms have introduced client-side encryption so that they themselves cannot read the content.

If the provider also controlled the encryption keys, they would still have the technical ability to decrypt the data. An independent external KACLS solves this problem by separating key control from the platform:

• True customer control — The organisation (or its chosen independent provider) holds and controls the keys.
• Zero access by the platform — Google, Microsoft or any other provider cannot read the encrypted content, even under legal pressure, because they do not have the keys.
• Data sovereignty and compliance — Essential for regulated industries, governments and companies that must prove a third party cannot access their data.
• Access control and revocation — Organisations can decide exactly who may decrypt content and can revoke access at any time (for example when employees or contractors leave).
• Auditability — All key access can be logged and reviewed according to the organisation’s own security policies.

In short, the platform provides the encryption capability, but an independent KACLS is what delivers real cryptographic control to the customer. Without it, “client-side encryption” would still leave the keys — and therefore the data — under the platform’s control.

VeraUno provides that independent KACLS, together with the optional email client and full management tools needed to operate it securely.