Key Management Service

Managed key management service for securing data on Aruba Cloud virtual infrastructure, including integration with VMware Virtual Private Cloud; billed hourly.

Create and manage cryptographic keys for encryption at rest and in transit with AWS-managed, customer-managed and imported keys, automatic rotation, and HSMs validated to FIPS 140-3 Level 3.

Fully managed service to store, rotate, and audit secrets such as database credentials, API keys, and OAuth tokens with native rotation Lambda integrations for RDS, Redshift, and DocumentDB

Single-tenant FIPS 140-3 Level 3 hardware security modules in your VPC for keys you must hold yourself: code signing, document signing, TLS offload and PKI roots where multi-tenant KMS is not acceptable for compliance.

Centralised vault for cryptographic keys, secrets, and certificates with HSM-backed keys, managed certificate renewal, and RBAC or access-policy enforcement

Single-tenant FIPS 140-3 Level 3 HSM clusters (three nodes) reached privately from your VNet, with customer-held admin control; supports PKCS#11, OpenSSL, JCA/JCE and CNG/KSP for PKI, TLS offload, TDE and code signing. Migration target for Dedicated HSM.

Bare-metal payment HSMs (Thales payShield 10K) provisioned in Azure for PCI-compliant payment processing such as PIN handling, card issuance and EMV key management, with full customer administrative control.

Managed key, secret and certificate store: Azure Key Vault operated by Bleu from data centres located exclusively in France, keeping keys within the Bleu perimeter.

Sovereign key management based on Cosmian KMS with master keys anchored in Thales Luna HSMs (FIPS 140-3 L3); KMIP 2.1, PKCS#11 and REST, BYOK/HYOK, integrating with Object Storage, Managed Kubernetes and Managed SIEM

Managed KMS for symmetric (AES-256-GCM) and asymmetric keys with multi-zone replication, envelope encryption and Object Storage server-side encryption; one key per organisation is free

Cloud-hosted key management for encryption at rest with symmetric and asymmetric keys, customer-supplied keys, HSM-backed keys, and automatic rotation

Fully managed secret storage with automatic replication across regions, VPC Service Controls integration, CMEK encryption, version history, per-secret IAM, and rotation via Cloud Scheduler plus Cloud Run hooks — used by GKE, Cloud Run, and Compute Engine workloads

FIPS 140-2 Level 3 hardware-protected keys exposed through the same Cloud KMS API as software keys — keys never leave the HSM hardware boundary, supporting workloads (PKI roots, code-signing, regulated payment flows) that need a hardware attestation rather than a multi-tenant software KMS

Unified cryptographic services including Key Management Service for envelope encryption, Cloud Secret Management Service for secret storage and rotation, Key Pair Service for SSH key management, and Dedicated HSM for FIPS 140-2 Level 3 workloads

Confidential computing family built on IBM LinuxONE and Secure Execution for Linux, including Hyper Protect Virtual Servers and Hyper Protect Crypto Services, whose keep-your-own-key HSMs are built on FIPS 140-2 Level 4 certified hardware that even IBM cannot access

Multi-tenant key management service providing envelope encryption for IBM Cloud data, with root keys backed by FIPS 140-2 Level 3 certified cloud HSMs and bring-your-own-key support

Centralised management of API keys, credentials, certificates and other secrets with dynamic secrets, rotation and IAM-based access control

Managed encryption-key service for creating, rotating and using keys for envelope encryption, backed by HSMs

Managed secrets store for credentials, keys and other sensitive configuration on NumSpot's sovereign platform; SecNumCloud PaaS qualification in progress (J0/J1 passed May 2026)

Key management service for symmetric and asymmetric keys, certificates, and other secret material — pluggable backends include software KMS, HSM via PKCS#11, Vault, and KMIP-compliant appliances. Equivalent to AWS KMS / Azure Key Vault / Cloud KMS in the cross-provider mapping

Centralised key and secret management service with HSM-backed symmetric and asymmetric keys, automatic rotation, and envelope encryption for OCI resources

Managed encryption-key service with HSM-backed customer master keys, automatic key rotation, envelope-encryption helpers, and audit logs of every key operation — used by OBS, EVS, and RDS for at-rest encryption

Centralised encryption-key management over KMIP and REST APIs, with BYOK, a fixed price per key per month and unlimited API calls. It is ISO 27001 and FIPS 140-3 Level 1 certified, with an optional HSM-backed tier (FIPS 140-3 Level 3).

Managed secrets vault with a REST API and HashiCorp Vault KV2-compatible API. It has native OVHcloud IAM integration, audit logs via Logs Data Platform, and is billed per secret version per month.

Managed encryption key service: Google Cloud KMS operated by S3NS within its SecNumCloud-qualified Cloud de Confiance, with keys located in the u-france-east1 region and CMEK for supported services. Cloud HSM protection levels, Autokey and EKM over internet are not available.

Encrypted storage for application secrets (API keys, database credentials, certificates) with versioning, rotation, and access-control via IAM policies

Managed encryption-key service for envelope encryption, with customer-managed keys (CMKs), HSM-backed key generation, and integration with Object Storage and Block Storage for at-rest encryption

Managed key service for creating or importing (BYOK) AES-256-GCM and RSA keys, with versioning and manual rotation, integrated into applications via the KMS API; generally available in EU01 and EU02

Vault-compatible encrypted storage for application secrets (API keys, credentials, certificates) with per-secret versioning and access control via ACLs and AppRole authentication

Managed cryptographic key service with customer master keys (CMKs), envelope encryption for Tencent services, automatic and manual rotation, imported key material (BYOK), Managed HSM for single-tenant FIPS 140-2 Level 3 compliance, and audit logging via CloudAudit