DYCRYPT Sovereign
DYCRYPT Sovereign runs inside your network and signs with your own HSM or PKCS#11 token. The private key that mints your licences never exists anywhere else — not in a vendor account, a reseller export, or our infrastructure.
Key custody
The private key stays on hardware you control. DYCRYPT sends a signing request through the protected boundary and stores the signed result, not an exportable private key.
Evidence, not assurances
The licence signature ties the product, customer, dates, machine binding, and typed claims to the key in your environment. Your application verifies that proof with the public key it already holds.
Online checks use signed receipts as well. TLS protects the request in transit; the receipt proves which key answered.
DYCRYPT has an operational history for licences and signing activity, but a separately specified tamper-evident audit log is not a published capability today.
If your submission requires append-only audit evidence with a defined retention and export format, treat that as an open requirement during procurement.
Regulatory fit
DYCRYPT can help you evidence software entitlement, key custody, and signed decisions. It does not make a product compliant with CRA, NIS2, IEC 62443, or medical-device rules by itself.
Disconnected operation
Offline applications verify a pre-bound licence locally and never contact DYCRYPT. That is available today for permanently disconnected installations.
A fully air-gapped DYCRYPT server with signed offline synchronisation bundles is not a published product today. Sovereign supports on-premises deployment; confirm any requirement for zero-connectivity server operation before purchase.
Long-lived products
DYCRYPT currently supports Ed25519, RSA 2048/3072/4096, and EC P-256/P-384. Public keys and X.509 certificates let your application verify without holding a secret.
ML-DSA and a post-quantum transition profile are not shipped capabilities today. Plan algorithm lifetime and field upgrades explicitly rather than assuming a licence signed now can change algorithms later.
What it costs
The starting figure covers the Sovereign product shape: on-premises operation, unlimited active licences, and customer-controlled HSM or PKCS#11 signing.
