What is CloudHSM?

In today’s digital landscape, data security is paramount. Encryption plays a critical role in safeguarding sensitive information, but securely storing encryption keys can be challenging. Traditional Hardware Security Modules (HSMs) provide robust protection but also demand substantial expertise, resources, and adherence to stringent security protocols. This is where CloudHSM comes in. It offers a cloud-based solution that delivers the benefits of traditional HSMs without the associated complexities.

What is CloudHSM?

CloudHSM is a cloud-hosted Hardware Security Module (HSM) service that enables you to perform cryptographic operations and manage encryption keys with enhanced security. This service is particularly beneficial for organizations with strict corporate, regulatory, or contractual compliance requirements. It also makes HSMs accessible to small and medium-sized businesses that may not have the in-house expertise and resources to manage them effectively.

Key Features of Securosys CloudHSM

• Managed Service: Securosys CloudHSM is a managed HSM service that allows you to securely generate, store and use encryption keys with your applications, eliminating the need for on-premises hardware.  
• Operates on a Patented HSM: Securosys CloudHSM operates on a proprietary hardware and software architecture, ensuring end-to-end control without intermediaries.
• Flexible Deployment: Available as dedicated HSMs or multi-tenant HSMs, Securosys CloudHSM can be tailored to meet various security and compliance needs.
• Global Availability: Compatible with all major cloud service providers, Securosys CloudHSM is accessible through regional clusters in Switzerland, Germany, Singapore, the US, and globally.
• Full Control: You don’t need to trust us with managing access to your secure keystore. With our Decanus Terminal’s Partition Administration functionality, you have the possibility to control access, configure settings, manage backups, and disable HSM administrator access.
• Extensive Cryptographic Features and API Integration: Securosys CloudHSM offers a broad range of cryptographic features to meet diverse security requirements. It also provides a REST API and a wide range of Primus API Providers (client API software/libraries) that ensure secure communication with the HSM and provide automatic failover and load balancing.

Who manages a CloudHSM?

The management of CloudHSM varies depending on the provider. At Securosys, when you subscribe to Securosys CloudHSM, you have the full access to your CloudHSM but the management of HSM is handled by Securosys on your behalf. We offer two different management options to suit varying needs:

• Dedicated CloudHSM (Platinum Offer): Each customer uses their own dedicated HSM, ensuring exclusive access and control.
• Multi-Tenant CloudHSM (Eco Offer): In this shared solution, customers are allocated a partition within an HSM, allowing for a cost-effective yet secure environment.

Are CloudHSMs as secure as on-premises HSMs?

CloudHSM is a cloud-hosted Hardware Security Module (HSM) service which delivers the same secured service than an HSM without owning and managing the hardware. It provides a secure and cost-effective path to be fully compliant with data security regulations. CloudHSM streamlines the generation, use, and storage of encryption keys, delegating the maintenance and updates to security experts, and therefore allowing you to focus on your core business activities.

What is the difference between CloudHSM and Bring your own key (BYOK)?

BYOK involves generating keys on-premises and securely transferring them to your cloud service provider, and thus allowing you to maintain control over your cryptographic keys used in the cloud. In contrast, CloudHSM provisions cryptographic services in the cloud, offering maximum flexibility and control without the need for on-premises hardware. All key operations are performed inside the HSM, ensuring the keys are not exposed outside the secured HSM environment

Enhance your cloud security by integrating CloudHSM with BYOK, achieving regulatory compliance and ensuring the security of sensitive data with top-tier hardware security module protection. Securosys also offers BYOK services. Discover more about Securosys BYOK.

What are typical use cases for CloudHSM?

CloudHSM can be used for various purposes, like Public Key Infrastructures, Key Management, Identity and Access Management, Data Encryption, TLS-Termination, Document Signing, Code Signing or Crypto Custody applications. The HSM is accessible remotely to authenticated subscribers in a High-Availability / Fail Over configuration. As a subscriber, you create, manage, and use the cryptographic keys within your partition by yourself and maintain full control over your key data.

Securosys CloudHSM encompasses the following services:

• HSM as a Service (HSMaaS), including:
  • a multi-tenancy HSM; or
  • a dedicated HSM owned and operated by Securosys; or
  • a customer owned HSM operated by Securosys; or
  • a multi-tenancy HSM for Bring Your Own Key purpose (BYOKaaS)
• Transaction Security Broker as a Service (TSBaaS)
• REST API as a Service (RESTaaS)
• Double Key Encryption as a Service (DKEaaS)

For more detailed information about Securosys CloudHSM, visit our resource library.