Hardware-backed protection for your most critical keys
Cryptographic keys are generated, stored and used inside tamper-protected Securosys HSMs, keeping sensitive key material protected throughout its lifecycle.
CloudHSM supports a broad range of cryptographic operations, including encryption and decryption, digital signatures, hashing, key generation and key management. Key attestation provides additional assurance by allowing organizations to verify that keys were generated and remain protected inside Securosys HSM hardware.
Approval-based key usage
CloudHSM controls not only who can access a key, but also under which conditions it can be used. With the patented Securosys Smart Key Attributes (SKA), policies such as m-of-n approvals can be attached directly to a key and enforced by the HSM before an individual signature or decryption operation is performed.
Approvals can come from people, machines or a combination of both, and are bound to the specific operation being requested. This enables use cases such as sole control for qualified signing, four-eyes approval for high-value transactions, controlled recovery of encrypted data and emergency blocking of automated or agentic systems.
Swiss operated, under Swiss jurisdiction
Securosys designs, builds and operates its own HSM technology. CloudHSM runs in high-security Swiss data centres and is operated by Securosys engineers under Swiss law, without relying on a hyperscaler or third-party HSM operator.
Key material is created inside the HSM and remains protected within the hardware. For organizations with different residency requirements, CloudHSM is also available from regional infrastructures in Germany, Singapore and the United States.
Fully managed HSM infrastructure
CloudHSM provides enterprise-grade HSM protection without requiring organizations to deploy and operate their own physical HSM infrastructure.
Securosys manages the underlying hardware, high-availability infrastructure, monitoring, maintenance and firmware updates. This reduces operational complexity and allows security and IT teams to focus on their applications and cryptographic policies rather than HSM administration.
Seamless integration with your existing environment
CloudHSM integrates into existing security and application architectures through widely adopted interfaces, including PKCS#11, JCE, Microsoft CNG and REST APIs.
This enables organizations to protect keys across use cases such as Public Key Infrastructure (PKI), Key Management Systems, database encryption, code and document signing, identity and access management, digital asset custody and Bring Your Own Key (BYOK). Integrations with leading cloud, security and enterprise platforms make it possible to introduce hardware-backed key protection without redesigning the existing infrastructure.
Flexible deployment for different security requirements
CloudHSM offers different service models to meet varying requirements for isolation, performance and compliance. Organizations can choose between shared and dedicated HSM infrastructure and scale their deployment as their requirements evolve.
Combined with regional availability across Switzerland, Germany, Singapore and the United States, this flexibility allows organizations to select the service model and location that best fit their security, availability and data residency requirements.
Security and compliance by design
CloudHSM is built on certified Securosys Primus HSM technology for organizations operating in regulated and security-sensitive environments. The same HSM technology secures the Swiss Interbank Clearing (SIC) system for SIX Interbank Clearing AG, under the supervision of the Swiss National Bank.
CloudHSM is based on hardware certified to FIPS 140-2 Level 3, Common Criteria EAL4+ and EN 419 221-5 and is operated under ISO/IEC 27001. It also supports qualified electronic signatures and seals under eIDAS and ZertES through qualified configurations.
Key attestation provides verifiable evidence that a key was generated inside genuine Securosys hardware and allows its attributes and usage policies to be independently verified, supporting audit and compliance requirements.
Ready for post-quantum cryptography
CloudHSM provides a crypto-agile foundation for the transition to post-quantum cryptography without requiring organizations to replace their underlying HSM infrastructure.
Post-quantum algorithms are supported alongside traditional cryptography, enabling organizations to test new algorithms, prepare applications for migration and continue protecting existing workloads during the transition. A dedicated CloudHSM Sandbox provides an accessible environment for integration, development and post-quantum testing.