|
Data Security Solutions – from WinMagicData Security Solutions – from WinMagic

Enterprise full-disk encryption

What is WinMagic SecureDoc?

WinMagic SecureDoc encrypts the disks of Windows and Linux computers and servers, manages Apple's FileVault on macOS, and encrypts removable media and files. Before a disk's key is released, a person signs in, or a policy you set lets the computer start on its own. Keys, policies and recovery for every device are kept on one server, SecureDoc Enterprise Server (SES).

A sign-in before the disk opens, with the keys on your own server.

Talk to WinMagic How SecureDoc works

By WinMagic. Updated .

WinMagic since 1997

Each certificate number opens its record on NIST's site.

  1. 1997WinMagic founded
  2. 2002FIPS 140-1, certificate #209
  3. 2006FIPS 140-2, certificates #698 and #699
  4. 2011PBConnex brings the pre-boot sign-in onto the network
  5. 2026FIPS 140-3, certificates #5204 and #5214

Strategic Partnerships with Industry Leaders

  • SanDisk
  • Ivanti
  • Toshiba Memory
  • National Research Council Canada
  • AccessData
  • Lite-On
  • HP
  • Lenovo
  • Intel
  • Micron
  • Microsoft

What it protects

What does SecureDoc protect?

The data on a computer or drive that is lost, stolen, sent for repair or thrown away.

Without the key, the disk can't be read. Encryption protects a computer that is turned off. Once a person has signed in, the data is open to them as on any computer, and from then on protecting it is the job of the operating system and the rest of your security.

Two states of an encrypted computer

  • Turned off Lost, stolen, sent for repair or thrown away. The disk can't be read without the key.
  • Signed in The data is open to the person signed in. The operating system and the rest of your security protect it from here.

What does SecureDoc do?

It encrypts, asks for a sign-in before the disk opens, manages everything from one server, recovers locked-out users and helps you show compliance.

  • Encrypts

    Whole disks on Windows and Linux computers and servers, with SecureDoc's own encryption, BitLocker, Opal self-encrypting drives or Linux's dm-crypt; FileVault on Macs; USB drives and other removable media; files and folders.

  • Asks for a sign-in before the disk opens

    Each person signs in before the operating system starts, with a password, smart card, USB token, certificate, biometric or TPM.

  • Manages everything from one server

    SecureDoc Enterprise Server (SES) runs on your own Windows Server. It holds the keys, the policies for each device profile and the audit trail, and keeps its users in sync with Active Directory.

  • Recovers

    When someone can't sign in, the help desk unlocks the computer with a challenge and response. BitLocker recovery keys are kept in SES.

  • Helps you show compliance

    FIPS 140-3 validated cryptographic modules, a pre-boot sign-in where NIST SP 800-111 and the DISA STIG expect one, and an audit trail on your own server.

Which platforms does SecureDoc cover?

Windows, macOS and Linux, managed from the same server.

  • Windows

    SecureDoc's own encryption, BitLocker, or Opal self-encrypting drives.

  • macOS

    FileVault 2, managed from SES.

  • Linux

    dm-crypt, on Ubuntu, Red Hat Enterprise Linux and SUSE.

What SecureDoc adds on each platform: BitLocker, FileVault and LUKS on How SecureDoc works.

BitLocker fleets

Keep BitLocker, add a sign-in for each person

SecureDoc adds its sign-in on top of the BitLocker encryption you already run, takes over its management and keeps its recovery keys. It is also a way forward for fleets that relied on MBAM, whose support ended on 14 April 2026, or on Dell's BitLocker Manager, whose support ended on 31 January 2026.

How: BitLocker management with SecureDoc's pre-boot sign-in.

Two people at a desk, one at a laptop and one pointing at a monitor

Help desk and users

No PINs to set or reset computer by computer

People sign in with their directory account, and with single sign-on SecureDoc carries them on into Windows. A forgotten password is solved with a challenge and response, or with self-help questions if you allow them.

How: PBConnex, single sign-on to Windows, password sync, challenge-response recovery.

Video: pre-boot network-based authentication with PBConnex.

Mixed fleets

One server for Windows, Mac and Linux

BitLocker, SecureDoc's own encryption, Opal drives, FileVault, Linux, USB drives and encrypted files: all managed from one console with one set of device profiles and one audit trail. On Linux, SES key management takes the place of LUKS's header and key slots.

How: SecureDoc Enterprise Server (SES); see BitLocker, FileVault and LUKS.

A tablet and a desktop monitor, each showing a username and password screen

Key custody

Your keys stay with you

SES runs on your own Windows Server and SQL Server. WinMagic holds no key to your data and built no recovery path around a person's secret, so WinMagic cannot open your disks.

How: on-premises SES with Active Directory sync; see keys and recovery.

A person working at a desk with two monitors

SecureDoc at a glance

Key facts, each with its source.

What it encrypts
Windows and Linux disks, servers, removable media, files and folders; manages FileVault 2 on macOS. Source: what it encrypts
Platforms
Windows, macOS, Linux (Ubuntu, Red Hat Enterprise Linux, SUSE). Source: platforms
Pre-boot sign-in
Before Windows or Linux starts: password, smart card (PIV, CAC), USB token, certificate, biometric or TPM, one Key File per person. On macOS, FileVault's own sign-in. Source: pre-boot sign-in
Network pre-boot
PBConnex checks the person against SES and Active Directory before the OS starts, wired or wireless. Launched in 2011. Source: network pre-boot
Works with
BitLocker, FileVault 2 and Opal self-encrypting drives; takes over existing LUKS and LUKS2 disks. Source: works with
Keys and recovery
On your own SES (Windows Server, SQL Server); challenge-response, self-help, crypto-erase. Source: keys and recovery
Cryptography
WinMagic's cryptographic modules hold FIPS 140-3 certificates #5204 (Windows) and #5214 (macOS and Linux), issued in March 2026. Sources: NIST #5204 NIST #5214
Made by
WinMagic, founded in 1997. Current release: SecureDoc 9.2 SR1. Source: current release

What does SecureDoc include?

Full-disk encryption with a pre-boot sign-in, BitLocker and FileVault management, Linux, file, server and removable-media encryption, all run from one server.

Standards and certifications

FIPS 140-3 validated cryptographic modules, a pre-boot sign-in where NIST SP 800-111 and the DISA STIG expect one, and encryption for disks, removable media and files.

Together they help meet the data-at-rest requirements of NIST SP 800-171, HIPAA and GDPR; for PCI DSS they cover removable media and add a layer on fixed disks.

  • FIPS 140-3

    WinMagic's cryptographic modules hold FIPS 140-3 certificates #5204 (Windows) and #5214 (macOS and Linux), issued in March 2026.

  • NIST SP 800-111

    The pre-boot sign-in; the guidance assumes full-disk encryption is configured to require one.

  • DISA STIG, Windows 11

    Pre-boot authentication for BitLocker (WN11-00-000031), or another full-disk encryption product that meets the same requirements.

  • NIST SP 800-171

    CUI at rest with FIPS-validated cryptography. It still governs CUI contracts; the requirement for third-party CMMC Level 2 certification has been suspended since 13 July 2026.

  • HIPAA

    Disk and removable-media encryption; HHS guidance points to NIST SP 800-111 for data at rest.

  • GDPR

    Encryption among the Article 32 measures; Article 34 on data made unintelligible.

  • PCI DSS 4.0

    Removable media, and one layer on fixed disks (requirement 3.5.1.2).

  • Audit trail

    Keys, policies, recovery and the audit trail kept on your own SES.

See requirement by requirement NIST SP 800-171 controls mapped to SecureDoc

Comparing SecureDoc with other products

Of the five products compared on How SecureDoc works (Sophos, ESET, Trellix, Symantec and BitLocker with Intune), none says on its own page that it covers Linux or checks the person at pre-boot over the network.

  • Linux included

    Ubuntu, Red Hat Enterprise Linux and SUSE, managed from the same server as Windows and macOS.

  • Pre-boot over the network

    PBConnex checks the person against SES and Active Directory before the OS starts. Launched in 2011.

  • Keys on your own server

    SES runs on your Windows Server and SQL Server.

See the full comparison

See SecureDoc on your own fleet

Talk to WinMagic about adding a pre-boot sign-in to the Windows and Linux computers you already have, with or without BitLocker, and keeping the keys on your own server.

Talk to WinMagic

Frequently asked questions

About SecureDoc

What is WinMagic SecureDoc?

WinMagic SecureDoc encrypts the disks of Windows and Linux computers and servers, manages Apple's FileVault on macOS, and encrypts removable media and files. Before a disk's key is released, a person signs in, or a policy you set lets the computer start on its own. Keys, policies and recovery for every device are kept on one server, SecureDoc Enterprise Server (SES).

Is SecureDoc FIPS validated?

Yes. WinMagic's cryptographic modules hold FIPS 140-3 certificates #5204 (Windows) and #5214 (macOS and Linux), issued in March 2026. WinMagic's modules have been validated under every FIPS 140 version since 2002.

Choosing and replacing disk encryption

What should I look for in enterprise full-disk encryption software?

Ask five questions: who the disk's key is released to at power-on (the computer alone, a shared PIN, or each person); whether it covers every operating system you run, Linux included; where keys and recovery live, in a vendor's cloud or on your own server; whether the cryptography is FIPS 140 validated; and whether it can take over the encryption you already have, such as BitLocker.

Do I need SecureDoc if we already use BitLocker?

Not to replace it. On a Windows fleet already encrypted with BitLocker, SecureDoc adds the sign-in and the management without changing the encryption: a pre-boot sign-in for each person, checked against your directory over the network, and keys, policies and BitLocker recovery keys on your own server.

What replaces MBAM now that its support has ended?

Microsoft ended extended support for Microsoft BitLocker Administration and Monitoring (MBAM) on 14 April 2026. Intune manages BitLocker from the cloud, with recovery keys kept in Microsoft Entra ID. SecureDoc manages BitLocker from your own server instead, keeps the recovery keys there, and adds a pre-boot sign-in for each person.

What should replace Dell Encryption now that support has ended?

Dell's maintenance and support for Dell Encryption, including BitLocker Manager and Self-Encrypting Drive Manager, ended on 31 January 2026. SecureDoc covers the disk side of it: its own full-disk encryption or BitLocker management on Windows, Opal self-encrypting drives and removable media, with keys on your own server. Plan to decrypt with the old product first, then encrypt with SecureDoc.

Can full-disk encryption be managed on-premises instead of in the cloud?

Yes. SecureDoc Enterprise Server (SES) runs on your own Windows Server with a SQL Server database. Keys, policies, recovery and the audit trail stay there.

How do I manage BitLocker, FileVault and Linux encryption from one console?

With SecureDoc Enterprise Server. One server and one set of device profiles cover BitLocker and SecureDoc's own encryption on Windows, Opal self-encrypting drives, FileVault 2 on macOS, dm-crypt on Linux, and removable media.

Sources

WinMagic pages opened 1 October 2026; Microsoft, Dell, standards and NIST certificate pages opened 12 to 14 October 2026. Last updated .

WinMagic

Certificates and standards

Microsoft and Dell

keyboard_arrow_up