diff --git a/src/FiscalOS.Core/Security/EncryptedDataKey.cs b/src/FiscalOS.Core/Security/EncryptedDataKey.cs
new file mode 100644
index 0000000..9014cac
--- /dev/null
+++ b/src/FiscalOS.Core/Security/EncryptedDataKey.cs
@@ -0,0 +1,21 @@
+namespace FiscalOS.Core.Security;
+
+public sealed record EncryptedDataKey
+{
+  public string KeyIdUsed { get; init; }
+  public string EncryptedKey { get; init; }
+
+  private EncryptedDataKey(string keyIdUsed, string encryptedKey)
+  {
+    KeyIdUsed = keyIdUsed;
+    EncryptedKey = encryptedKey;
+  }
+
+  public static EncryptedDataKey From(string keyIdUsed, string encryptedKey)
+  {
+    ArgumentNullException.ThrowIfNull(keyIdUsed);
+    ArgumentNullException.ThrowIfNull(encryptedKey);
+
+    return new(keyIdUsed, encryptedKey);
+  }
+}
\ No newline at end of file
diff --git a/src/FiscalOS.Core/Security/IEncryptor.cs b/src/FiscalOS.Core/Security/IEncryptor.cs
new file mode 100644
index 0000000..caf5803
--- /dev/null
+++ b/src/FiscalOS.Core/Security/IEncryptor.cs
@@ -0,0 +1,11 @@
+namespace FiscalOS.Core.Security;
+
+public interface IEncryptor
+{
+  string GenerateKey();
+  Task<EncryptedDataKey> GenerateEncryptedKeyAsync(CancellationToken ct);
+  Task<string> EncryptAsync(string plainText, CancellationToken ct);
+  Task<string> EncryptAsyncFor(User user, string plainText, CancellationToken ct);
+  Task<string> DecryptAsync(string cipherText, CancellationToken ct);
+  Task<string> DecryptAsyncFor(User user, string plainText, CancellationToken ct);
+}
\ No newline at end of file
diff --git a/src/FiscalOS.Core/Security/IKeyRing.cs b/src/FiscalOS.Core/Security/IKeyRing.cs
new file mode 100644
index 0000000..52b9092
--- /dev/null
+++ b/src/FiscalOS.Core/Security/IKeyRing.cs
@@ -0,0 +1,8 @@
+namespace FiscalOS.Core.Security;
+
+public interface IKeyRing
+{
+  KeyRingEntry GetKey(string keyId);
+  KeyRingEntry GetPrimaryKey();
+  Task<KeyRingEntry> SaveKeyAsync(string key);
+}
\ No newline at end of file
diff --git a/src/FiscalOS.Core/Security/KeyRingEntry.cs b/src/FiscalOS.Core/Security/KeyRingEntry.cs
new file mode 100644
index 0000000..8e945fd
--- /dev/null
+++ b/src/FiscalOS.Core/Security/KeyRingEntry.cs
@@ -0,0 +1,21 @@
+namespace FiscalOS.Core.Security;
+
+public sealed record KeyRingEntry
+{
+  public string KeyId { get; init; }
+  public string Key { get; init; }
+
+  private KeyRingEntry(string keyId, string key)
+  {
+    KeyId = keyId;
+    Key = key;
+  }
+
+  public static KeyRingEntry From(string keyId, string key)
+  {
+    ArgumentNullException.ThrowIfNull(keyId);
+    ArgumentNullException.ThrowIfNull(key);
+
+    return new(keyId, key);
+  }
+}
\ No newline at end of file
diff --git a/src/FiscalOS.Core/Usings.cs b/src/FiscalOS.Core/Usings.cs
index 05db914..67bbe27 100644
--- a/src/FiscalOS.Core/Usings.cs
+++ b/src/FiscalOS.Core/Usings.cs
@@ -1,3 +1,3 @@
 global using FiscalOS.Core.Data;
-
-global using FiscalOS.Core.Identity;
\ No newline at end of file
+global using FiscalOS.Core.Identity;
+global using FiscalOS.Core.Security;
\ No newline at end of file