I have a laptop that has Sophos Safeguard full disk encryption on it. I booted the machine into another operating system on a USB stick and attempted to read the disk from the other OS, and I verified that the disk was encrypted and I could not read it. This machine does not have a TPM chip. I do not have to enter a PIN or a passphrase or insert a USB stick when I boot it up - it loads up the operating system seamlessly. Given these facts, where is the encryption key stored and how could it be stored securely?
From what I can find on Sophos website, it looks like the encryption keys and revelant certificates are stored on a mssql database which holds the information.
The SafeGuard Enterprise Database(s) hold all relevant data such as keys/certificates, information about users and computers, events and policy settings. The database(s) need to be accessed by the SafeGuard Enterprise Server and by one security officer only through the SafeGuard Management Center, usually the Master Security Officer. The SafeGuard Enterprise Database(s) can be generated and configured using a wizard or scripts. http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sgn_61_ig_eng_installation.pdf?la=en