Porticor's approach is based on the concept of the safe deposit box that has two keys -- one for the customer and the other for the banker, or in this case, the Porticor Virtual Key Management Service. Just like the safe deposit box, the customer can't decrypt the data without the key held by Porticor, and Porticor can't decrypt the data without the master key held by the customer. In practice, the customer actually has one key per project, which is usually an application. Porticor has thousands of keys, one for each file or disk belonging to that project. Still, the keys must pair up in order to provide access to the encrypted data.
Beyond the keys being split between the customer and Porticor, the unique part of the solution is the keys themselves are encrypted by the customer's master key, which only the customer holds and knows. As a result, Porticor holds project keys but the vendor can't read them because they are encrypted. By encrypting the "banker" keys with the customer master key, Porticor gives the customer complete mitigation of end data protection. The customer must write down the master key and literally store it in a steel box. Once that is done, no one in the world other than the steel box ever sees the key. (Another option is to put the master key in an escrow service.)
Architecturally, the Porticor solution sits between the cloud based server and storage, ensuring that every bit of data between the servers and the storage is encrypted and every bit of data moving from storage to the servers is decrypted for customer initiated processes. The piece in the middle is the heart of the Portico solution, the Virtual Private Data (VPD) application. VPD is a virtual appliance that encrypts any disk or storage array with encryption algorithms such as AES-256. VPD retrieves the "banker" keys as well as requesting from the customer its key.
Porticor says this is military-grade security since only one party -- the customer -- holds the master key to unlock the data. (Hint: Don't lose the master key or you're up the creek without a paddle.) The master key only needs to be brought out of the steel vault when the entire server cluster is rebooted, which should be a rare occurrence. When new application servers are created, they inherit the encryption automatically through the VPD.
Security- and risk management-wise, the Porticor process does not save a "plain key" to any disk. Then, even if a hacker has penetrated the service provider's network searching for data, the hacker will not see anything to steal.
The Porticor solution is designed to work with any cloud implementation. Today, Porticor has established partnerships with Amazon Web Services (AWS) and Red Hat, making the choices of those two services extra easy.