Panocrypt

Linux Encryption. Everywhere.

The control plane for Linux encryption at rest. Freedom to choose your infrastructure.

Get started

Works with the Linux encryption stack your team already trusts.

Ubuntu
Debian
Fedora
CentOS
Rocky Linux
AlmaLinux
Omarchy

Native packages

Uses the encryption stack already shipped by mainstream Linux distributions.

Standard format

Built on tried-and-true Linux Unified Key Setup (LUKS).

Local keys

The unlock key is created, wrapped, and stored on the host.

Existing LUKS

Already encrypted hosts bind an unused keyslot without custom agents.

Encryption is required.
Big Cloud tax is not.

100x
Lower egress fees
2.3x
Cheaper 8‑GPU H200
0
Disk keys in escrow

Cloud freedom

Use the providers with cheaper bandwidth and better GPUs without giving up the encryption controls your security team expects.

Reboot-safe operations

Headless servers come back on their own, unlocked only when your policy allows.

Audit-facing evidence

See what's covered, what changed, and what's been disabled, from one control plane.

Bring the controls.
Move the workload.

Outside Big Cloud, bandwidth costs less and new GPUs are easier to get. What's been missing is the encryption story your security team depends on. Panocrypt brings those controls with you, so the best infrastructure is no longer off-limits.

See how it works
Cloud freedom

Run where the workload fits.

Pick providers for bandwidth, GPUs, region, and capacity. Your encryption controls come with you.

Explore
Network economics
Stop paying the bandwidth markup
Hyperscaler egress feesbaseline
Bandwidth-first hostup to 100x cheaper
Traffic-heavy systems stay eligible.

Keep Linux encryption controls while evaluating providers by bandwidth economics.

Lower egress fees

Move bandwidth-heavy systems where data transfer doesn't carry the Big Cloud markup.

GPU supply

Dedicated capacity

Make Big Cloud compete

Get started

Make encryption the default.

Bind what's already encrypted, or set up a fresh host that encrypts itself.

Explore
Managed unlock
Anywhere Linux runs
Any cloud or on-prem
Bind without provider support, even in your own racks.
Bare metal and dedicated
Headless reboots under policy.
Edge devices
Field hardware that boots unattended.

Unlock anywhere

Managed unlock isn't tied to a provider list. Any Linux system with full-disk encryption can bind to Panocrypt: cloud, on-prem, even devices in the field. No agent.

Automatic encryption

Works with your provider

Bind existing hosts

Control plane

Make encryption operational.

Turn disk encryption, boot-time unlock, evidence, and decommissioning into a repeatable workflow.

Explore
Unlock policy
You decide who unlocks
Source networks
Allowlist the CIDRs that may unlock.
Lifecycle state
Active devices only.
Manual approvals
Add a human in the loop.

Set unlock policy

Choose which devices may unlock, from which source networks, in which lifecycle state.

Verify encrypted boot

Reboot by policy

Clean exit

Compliance

Make encryption auditable.

Security teams need visible controls before sensitive workloads leave the default cloud path.

Explore
Fleet coverage
Covered systems are visible
Registered
84
Bound
72
Allowed to unlock
68
Needs review
4

Show coverage

Track which Linux systems are registered, bound, allowed to unlock, disabled, or decommissioned.

Control unlocks

Track changes

Security review

Safe and secure

Panocrypt is a Fraudmarc service from a team running production infrastructure since 2005 and authorizing billions of enterprise emails each month. We bring that same operating discipline to Linux encryption at rest.

Read our trust model
SOC 2
audited

Start with a server.
Grow with your fleet.

Linux encryption controls for every stage. Choose the audit history and scale your team needs.

Free

For your first encrypted servers.

$0

Free to get started

Get started
  • 7-day audit history
  • 5,000 recovery requests / month
  • One organization

Pro

For operators growing their fleet.

$20

per month

Get started
  • 90-day audit history
  • 100,000 recovery requests / month
  • Up to 5 child organizations

Business

For teams running across providers.

$200

per month

Get started
  • 1-year audit history
  • 1 million recovery requests / month
  • Up to 25 child organizations

Enterprise

For larger fleets and specific requirements.

Let’s talk

A plan for your organization

Contact us

  • Customer-controlled cryptographic roots

    Add a cryptographic dependency under your control to Panocrypt-managed unlock.

  • 6-year audit history
  • Higher-volume recovery
  • Up to 250 child organizations

Every plan includes

  • Managed unlock
  • Source-network policies
  • Device lifecycle controls
  • Non-escrow architecture