Protect every key to ISO 27001 standard
Your keys are worth real money, so Alaska treats them that way. Certified to ISO/IEC 27001:2022, with single sign-on through Microsoft or MFA-protected passwords, least-privilege permissions, protected delivery and a complete audit trail.
Keys are money. Most tools treat them like text.
Spreadsheets and email were never built to protect something this valuable.
Keys in plain email
Keys pasted into email can be forwarded and lost, with no way to know it happened.
Everyone sees everything
A shared spreadsheet gives every person access to every key, whatever their role.
No record of who did what
When an auditor asks who changed a SKU or approved a request, a spreadsheet can't answer.
Security at every step
From sign-in to delivery to audit, each layer is built in, not bolted on.
ISO/IEC 27001:2022
K3YS Limited is assessed and approved by CQS (Certified Quality Systems) Limited to ISO/IEC 27001:2022.
Secure sign-in
Single sign-on with Microsoft Entra ID, or email and password with authenticator-app MFA that you can make mandatory. Accounts lock after repeated failed logins.
Least-privilege access
Around 30 fine-grained permissions, scoped by company and territory, with ready-made Administrator, Approver, Key Requester and Key Uploader roles.
Protected delivery
Password-protected zip files with the password sent separately, and keys over the Partner API encrypted with AES-256-GCM using a customer-specific key.
Direct to recipientsA complete audit trail
Companies, games, SKUs, workflows, users, promotions and requests each have an audit timeline with comments, plus per-key history and download logs.
Key history & searchEngineering discipline
Extensive automated test coverage, secret scanning on every change, continuous static code analysis and secrets kept in cloud secret stores.
A great key management solution.
“Alaska lets us securely manage, distribute and audit keys internally and externally across all platforms. Working with the K3YS team has allowed us to work smarter, streamline internal processes and facilitate demand for our product.”
Security & compliance, answered
Something else on your mind? Ask us in a demo or email alaska@k3ys.co.
What does the ISO 27001 certification cover?
The certification applies to the approved Information Security Management System relating to the provision of scalable digital serial key management software, cloud hosting and consultancy for the games industry.
How do people sign in?
With single sign-on through Microsoft Entra ID, with optional automatic user provisioning, or with email and password protected by authenticator-app MFA, which you can make mandatory. Sign-in is standards-based (OpenID Connect / OAuth2).
How are keys protected when they're delivered?
Files are password-protected zips with the password sent separately, and every download is logged. Keys delivered over the Partner API are encrypted with AES-256-GCM using a customer-specific key.
Can our support team see what a user sees?
Yes. Admins can impersonate a user to fix issues fast. Impersonation requires its own permission.
Does the audit trail help with our own audits?
Yes. Every important record has an audit timeline showing who created, edited, approved, declined, downloaded, uploaded or disabled, and when, plus "who changed what" reports for users, games, SKUs and workflows.
See security & compliance in action
Book a walkthrough and we'll show you how security & compliance would work with the way your team already manages keys.