Confidential computing family built on IBM LinuxONE and Secure Execution for Linux, including Hyper Protect Virtual Servers and Hyper Protect Crypto Services, whose keep-your-own-key HSMs are built on FIPS 140-2 Level 4 certified hardware that even IBM cannot access
FluffyStack toolsJurisdictional exposure
Attributes
- Fips
- 140-3 Level 4
Sub-services (3)
Hyper Protect Virtual Servers
LinuxONE-backed confidential VMs with memory and disk encryption by default
Hyper Protect Crypto Services
FIPS 140-3 Level 4 HSMs with Keep Your Own Key and dedicated customer control
Hyper Protect DBaaS
PostgreSQL and MongoDB instances with customer-held encryption keys
Compliance & Certifications
This service is attested for the following frameworks. Always verify with the provider before relying on a specific compliance posture.
Where this runs
Commercial regions (13)
Europe (3)
- Frankfurt
- Madrid
- London
North America (4)
- Montreal
- Toronto
- Dallas
- Washington DC
South America (1)
- São Paulo
Asia (4)
- Chennai
- Mumbai - Airtel
- Osaka
- Tokyo
Oceania (1)
- Sydney
Tags
Equivalent services on other platforms
Managed key and secrets service with software and hardware-backed (HSM) key management, envelope encryption for Alibaba Cloud services, automatic rotation and dedicated KMS instances
Single-tenant FIPS 140-3 Level 3 hardware security modules in your VPC for keys you must hold yourself: code signing, document signing, TLS offload and PKI roots where multi-tenant KMS is not acceptable for compliance.
VMs and containers that keep data encrypted while in use via AMD SEV-SNP and Intel TDX hardware enclaves, plus Always Encrypted for Azure SQL, Confidential Containers on AKS, and the Managed HSM to protect cryptographic keys — for regulated workloads demanding runtime protection
Single-tenant FIPS 140-3 Level 3 HSM clusters (three nodes) reached privately from your VNet, with customer-held admin control; supports PKCS#11, OpenSSL, JCA/JCE and CNG/KSP for PKI, TLS offload, TDE and code signing. Migration target for Dedicated HSM.
Bare-metal payment HSMs (Thales payShield 10K) provisioned in Azure for PCI-compliant payment processing such as PIN handling, card issuance and EMV key management, with full customer administrative control.
FIPS 140-2 Level 3 hardware-protected keys exposed through the same Cloud KMS API as software keys — keys never leave the HSM hardware boundary, supporting workloads (PKI roots, code-signing, regulated payment flows) that need a hardware attestation rather than a multi-tenant software KMS
Unified cryptographic services including Key Management Service for envelope encryption, Cloud Secret Management Service for secret storage and rotation, Key Pair Service for SSH key management, and Dedicated HSM for FIPS 140-2 Level 3 workloads
Dedicated-core VMs running in an AMD SEV-SNP trusted execution environment with per-VM memory encryption and customer-run attestation, built from customer-owned images; available in Frankfurt (de/fra/2) on AMD EPYC Turin.