Services / HSM
Hardware Security Modules
Hardware-backed protection for the keys that cannot be allowed to leak.
What we do
- HSM selection, sizing, and architecture, on-premises, cloud, and hybrid
- Hands-on with Thales Luna and SafeNet, Entrust nShield, and YubiHSM
- Integration with AD CS, EJBCA, and Keyfactor for CA key protection
- Code-signing programs: Authenticode, Apple notarization, and timestamped, hardware-backed signing keys
- TLS, database, and application key protection
- PKCS#11, KMIP, and vendor toolchain configuration
- Dual control, split knowledge, and quorum-based administration
- Backup, cloning, and disaster recovery that has actually been tested
- FIPS 140-2 and 140-3 compliant operations and key management governance
When to call
Your CA or code-signing keys live in software and a compliance deadline says they cannot.
You own an HSM but only one person knows how to operate it.
You need to move keys between HSM vendors, generations, or clouds without a gap in service.
Nobody has ever restored from your HSM backup, and you would like to know whether it works.
Put the keys somewhere safe.
We will help you pick the hardware, wire it in, and write down how to run it.