phylax (Greek "guardian") is a thin, safe-by-default binding to the Windows Cryptography API: Next Generation (CNG / bcrypt.dll) and DPAPI. It does not implement any cryptography of its own — it exposes the operating system's own validated primitives through an ergonomic, hard-to-misuse Ruby API: a cryptographically secure RNG, SHA-2 hashing and HMAC (one-shot and streaming), PBKDF2 key derivation, authenticated AES-256-GCM encryption (SecretBox, with nonces generated and framed automatically so reuse is impossible), a constant-time comparison, and DPAPI protect/unprotect for secrets at rest. Windows MSVC (mswin) Ruby only.