SELF-HOSTED PII VAULT

Every PII vault asks you to send them your personal data. Obsydia never receives it.

Core0 runs inside your infrastructure. There is no telemetry, no remote licence check and no vendor endpoint in the request path. We could not hand your data to a regulator, an attacker or a court even if we wanted to — we never hold it.

Encryption at rest solves the wrong problem

Disk encryption protects you from someone stealing the server. Nobody steals the server. Data leaves through SQL injection, an over-permissive API, a leaked backup, a support tool with too much reach — and in every one of those cases the database was mounted, decrypted and answering queries.

Tokenisation changes what the attacker gets. Your application database holds references. The personal data lives somewhere else, behind its own keys, its own access control and its own audit trail.

Tokenisation is not another word for encryption

Encryption keeps data readable to whoever holds the key, and in a running system that is your application, all day, by design. Tokenisation removes the data instead. Your application stores a reference — a string with no relationship to the value it stands for, from which nothing can be derived, because there is nothing inside it to derive from.

The practical difference shows up on the day something goes wrong. An encrypted database that an attacker reaches through your application is decrypted for them, because the application is authorised and the attacker is using it. A tokenised database yields a list of references and no way to resolve them without separately compromising the vault, its keys and its access control.

It also changes what a subject access request costs you. When personal data lives in one place instead of scattered across a dozen services, finding everything about one person is a query rather than a week of engineering. Erasure stops being an act of faith that no copy survived in a log, a replica or last month's backup.

Who runs it

Organisations in the UK and EU that hold regulated personal data and have to demonstrate, not merely assert, that no third party can reach it. Fintech, healthtech and legaltech mostly — and any business whose auditors have started asking pointed questions about processor access, or whose largest customer has begun sending security questionnaires that a managed vault cannot honestly answer.

The common thread is not size. It is that somebody has become personally accountable for where the personal data sits, and has concluded that a contractual promise from a cloud provider is not the same thing as a technical guarantee.

What we build

Priced as a licence, not a meter

Vaults that bill per operation charge you every time you protect a customer. Core0 is licensed annually, from £3,490 a year. Volume changes nothing. See the editions.

Verify before you trust

Everything above is checkable. Point a packet capture at a running node and watch it stay silent. Read the architecture, the threat model and the API surface before you talk to us — that order suits us fine.