IONU Security, Inc. (pronounced “eye on you”) thinks it has a better way to make data encryption viable in the enterprise while plugging one of the persistent holes in the ways in which most organizations implement encryption.

The flaw in most current schemes is that data is typically decrypted once it arrives on a host machine or cloud server for use by local programs. That forces organizations to use firewalls, proxies and gateways to block intruders. However, many security experts now believe that intrusion prevention is all but impossible. The only effective approach to security is to make the data unreadable at all times.

That’s what IONU proposes to do with its data isolation approach, which creates a logically separate and secure “zone” where data is insulated from the outside world.  Data is fully usable while in a zone, but is encrypted  while in transit or not in use by programs.

“Data is always encrypted except when you’re working on it,” said Dave Bennett, chief technical officer at IONU. Data is unencrypted for loading into Microsoft Word, for example, he said, but automatically encrypted when saved to disk.

Bennett said his company’s technology is ideal for cloud environments, where data is typically unencrypted once it is stored on cloud servers. In the case of Dropbox, for example, “you’re going to use SSL to communicate your data to Dropbox and then Dropbox is going to receive your data, decrypt it and store it in its cloud storage structure,” he said. ”If I can get access to the Dropbox keyps, I can get access to all of your files.”

IONU addresses this shortcoming by not storing the full encryption keys in one place. Data can only be decrypted by a combination of keys from the server and client or between two parties in an email exchange, for example. No single entity has enough information to access encrypted data. “An intruder would have to both client and server to get data and even then it would only apply to the device they hacked into,” Bennett said. The result is that data stored using the IONU encryption scheme can never be downloaded or otherwise extracted while in a clear state, and is never decrypted on a cloud server. All of this is transparent to the user, who simply has to fill out a simple form to  obtain an encryption key.

IONU is making its technology available as a free download, with a pro service available for businesses.