What Cloud HSM is

A hardware security module, delivered like a cloud service.

An HSM keeps keys inside tamper-resistant hardware and performs signing, encryption and key wrapping there. A cloud HSM is the same hardware run as a service: the provider installs, powers, patches and monitors the appliances, and you get a dedicated partition with its own keys, users and policy. You never touch a screwdriver, and the provider's staff never touch your keys.

XcellTrust Cloud HSM runs those partitions in our Mumbai Tier IV data centre, with a DR copy at a partner data centre*. Your applications connect over private connectivity or IPsec through our cloud router — from AWS, Azure, Google Cloud, Oracle Cloud or your own servers — so one set of keys can serve several clouds while staying in India, billed in INR.

Cloud KMSProvider-managed key service

Convenient and cheap. Keys usually sit in the provider's shared HSM fleet and the provider runs everything.

Cloud HSMDedicated HSM capacity as a service

Your own partition or cluster. Standard crypto APIs, your admin credentials, provider runs the hardware.

On-prem HSMAppliances you buy and run

Full physical control, plus capex, rack space, firmware, spares and 3 a.m. alerts.

Serves keys to AWS · Azure · Google · Oracle CAs & signing platforms Databases & storage Payment & tokenisation apps On-prem & private cloud
XcellHost Cloud HSM

Everything a regulated key needs, on one partition.

OEM appliance models and exact certificates are confirmed in your quotation (OEM to be confirmed*). The service around them is ours.

Dedicated partitions on certified hardware

Each partition is a cryptographically separate slot on network HSMs validated to FIPS 140-3 Level 3* — its own keys, users, policy and audit trail. Need more throughput or another environment? Add partitions, not hardware.

Private access only

Reach your partition over private connect from the hyperscalers or IPsec via cloud router. No HSM port faces the internet.

Standard client APIs

PKCS#11, Java JCE, Microsoft CNG/KSP, KMIP and REST* — most CAs, databases and signing tools connect without code changes.

M-of-N quorum

Partition administration and key export policies need a quorum of your custodians — for example 3 of 5 — so no single person, including ours, can act alone.

Audit logs you keep

Every login, key operation and policy change logged, streamed to your SIEM or our SOC and retained for CERT-In's 180 days.

HSM-wrapped backups

Key material is backed up only in wrapped form to HSM backup partitions, never as plaintext files, under the same quorum.

HA in Mumbai, DR at a partner data centre*

Partitions are mirrored across two HSMs in our Mumbai Tier IV facility for availability, with a DR replica at a partner data centre in India* that you approve. Failover is tested on a schedule and logged.

India data residency

Keys, backups and logs stay in Indian data centres. You know the building, not just the region.

24×7 NOC + SOC

Health, capacity, certificate expiry and tamper events watched round the clock from Mumbai.

Compare cloud HSMs

XcellHost, AWS, Azure, Google or your own rack?

Facts from each provider's public documentation, checked October 2026. "—" means we could not confirm it from the provider's docs. Hyperscaler prices are not shown; they bill you directly.

 XcellHost Cloud HSMAWS CloudHSMAzure Cloud HSM / Managed HSMGoogle Cloud HSMOn-prem HSM
What you getDedicated partition on HSMs run by XcellHostSingle-tenant HSMs in a cluster in your VPCCloud HSM: single-tenant, three-node cluster. Managed HSM: fully managed, single-tenant HSM poolCloud KMS keys at HSM protection level, multi-tenant or single-tenantAppliances you buy and own
FIPS validationFIPS 140-3 Level 3 hardware*hsm2m.medium: FIPS 140-3 Level 3 in FIPS mode. hsm1.medium (FIPS 140-2): no new clustersFIPS 140-3 Level 3 (both services)FIPS 140-2 Level 3 (HSM level)Per model and firmware
India locationsMumbai Tier IV; DR at a partner DC in India*Mumbai (ap-south-1), Hyderabad (ap-south-2)—Mumbai (asia-south1), Delhi (asia-south2)Your sites
Client interfacesPKCS#11, JCE, CNG/KSP, KMIP, REST*PKCS#11, JCE, OpenSSL Dynamic Engine, KSPCloud HSM: PKCS#11, OpenSSL, JCA/JCE, CNG/KSP. Managed HSM: Key Vault APICloud KMS API; PKCS#11 libraryPer OEM
Hold-your-own-key optionCan sit behind a cloud's external key service through a compatible proxy*AWS KMS external key store (XKS)—Cloud EKM (over internet or VPC)Through a proxy or EKM partner
Reach from other cloudsPrivate link or IPsec from any cloud or DCFrom your AWS VPCFrom your Azure virtual networkVia Google Cloud APIsYour network design
Who runs the hardwareXcellHost 24×7; you hold partition credentials and quorumAWS; you manage HSM users and keysMicrosoft; you hold the security domainGoogle; you control keys through IAMYou
BillingINR GST invoice, from ₹24,999* / partition / monthBilled by AWSBilled by MicrosoftBilled by GoogleCapex + support, on quote
Watch-outsNetwork path to each cloud must be designedPlan hsm1 → hsm2m migrationAzure Dedicated HSM retires 31 Jul 2028; Cloud HSM is its successorSingle-tenant in a subset of locationsLead time, spares, firmware, staff
Hyperscaler key services we design, integrate and run
AWSAWS CloudHSM · AWS KMS

CloudHSM clusters of single-tenant HSMs. AWS KMS custom key stores can be backed by a CloudHSM cluster or by an external key manager outside AWS through an XKS proxy — AWS suggests keeping round-trip time to 35 ms or less.

AWS services → AzureCloud HSM · Managed HSM · Dedicated HSM

Azure Cloud HSM became generally available in July 2025 as the successor to Dedicated HSM, which takes no new customers and is supported until 31 July 2028. Managed HSM is the fully managed, Key Vault-style option.

Azure services → GoogleCloud HSM · Cloud EKM

Cloud HSM is the HSM protection level of Cloud KMS, multi-tenant or single-tenant. Cloud EKM keeps key material in your external key manager, so Google Cloud cannot access it.

Google Cloud services → OracleOCI Vault · Dedicated KMS · External KMS

Vault offers shared (Virtual Vault) or dedicated-partition (Private Vault) HSM keys. Dedicated KMS is a single-tenant HSM partition with PKCS#11. External KMS keeps master keys outside OCI.

Oracle Cloud services →

Sources: AWS CloudHSM and AWS KMS developer guides; Microsoft Learn (Azure Cloud HSM, Managed HSM, Dedicated HSM); Google Cloud KMS documentation; Oracle key-management pages — all checked October 2026. Services, regions and certificates change; we re-check them for your design. * XcellHost items marked with an asterisk are indicative and confirmed in your quotation.

Key-control models

Who holds the key, and who can say no?

Every cloud encryption setup sits somewhere on this line. Move right for more control, and accept more responsibility for availability.

—

—

Key generated in—Key lives in—Cloud can use it without you?—How you revoke—
Control vs convenience
Control
Convenience
Your availability duty

—

Multi-cloud key management

Many Indian enterprises run on more than one cloud. Keeping a master copy of each key in one HSM in Mumbai — and importing or proxying it into each cloud — gives one rotation schedule, one audit trail and one place to revoke.

Key sovereignty for regulated entities

Banks, NBFCs, insurers, market intermediaries and CAs are asked where keys live and who can reach them. A named Indian facility, your own quorum and an exportable audit log answer that directly.

The trade-off with HYOK

If the external key manager is unreachable, the cloud service cannot decrypt. HYOK needs HA, DR and low-latency links designed in — which is why we pair it with two Mumbai HSMs and a DR site.

Use cases

What teams put in a cloud HSM partition.

PKI & certificate authorities

Root and issuing CA keys under quorum; certificates, CRLs and OCSP signed inside.

Private CA → Code signing

CI pipelines sign builds through PKCS#11 or CNG; the key never reaches a build agent.

Cloud Code Signing → Document & eSigning

Bulk-sign invoices, contracts and approvals with organisation keys held in hardware.

Document Signing → TLS offload

Web and API TLS keys sign handshakes inside the HSM, out of server memory.

Certificate lifecycle → Database TDE

Master keys for SQL Server, Oracle and others held via PKCS#11, CNG or KMIP.

Database Operations → Tokenisation, cards & UPI

Token-vault and data keys on a partition; PIN and card keys need payment HSMs, offered as a service by some clouds (for example Azure Payment HSM) or hosted by us on quote.

Payment HSM options → Blockchain custody

Wallet and validator keys signed in hardware on supported curves*, beside approval policies.

Blockchain security → IoT device identity

The device-issuing CA key stays in the partition while the factory line requests certificates.

IoT PKI → Aadhaar Data Vault

UIDAI expects Aadhaar numbers in a vault whose keys are held in an HSM (FIPS 140-2 Level 3 per UIDAI's FAQ).

vDPO service → Post-quantum readiness

Test ML-KEM and ML-DSA on supported firmware* and change algorithms without moving keys out of hardware.

Quantum readiness → BYOK & HYOK for SaaS and clouds

Generate keys you import into cloud KMS, or keep them here and let the cloud ask each time.

Key-control models → Need your own appliance?

For workloads that must sit on hardware you own, see our dedicated HSM page.

HSM appliances →
Migration path

Moving keys is a ceremony, not a copy-paste.

Two journeys we run most often. Whether a key can move at all depends on how it was created; non-extractable keys are re-issued, not exported.

Journey A

On-prem HSM → XcellHost Cloud HSM

  1. 1InventoryEvery key, its attributes, owners, applications and expiry.
  2. 2Decide per keyWrapped transfer where the OEM and policy allow it; otherwise generate new keys and re-issue certificates.
  3. 3CeremonyPartition initialised, quorum cards issued, transfers witnessed and recorded.
  4. 4Parallel runApplications switched one at a time over private link; old HSM stays live as fallback.
  5. 5RetireOld appliances zeroised under witness; certificate of destruction kept for audit.
Journey B

Azure Dedicated HSM retirement

31 July 2028Microsoft's end of support for existing Dedicated HSM customers; no new onboardings.
Azure Cloud HSMMicrosoft's named successor; single-tenant, FIPS 140-3 Level 3, PKCS#11 / OpenSSL / JCE / CNG.
Azure Managed HSMIf your apps can use Key Vault APIs instead of PKCS#11.
XcellHost Cloud HSMIf you want keys in a named Indian facility, reachable from Azure and other clouds, billed in INR.

Also on the calendar: AWS CloudHSM no longer creates new hsm1.medium clusters (move to hsm2m.medium), and India's CCA stops DSC issuance on FIPS 140-2 modules from 21 September 2026, with full retirement by 21 September 2029.

India compliance

Cloud HSM helps you meet what Indian regulators ask.

A cloud HSM is a control, not a compliance certificate. This is where it fits.

CCA
FIPS 140-3 migration for CAs & eSign

CCA's advisory: no new FIPS 140-2 module audits from 1 January 2026, no DSC issuance on FIPS 140-2 modules after 21 September 2026, and non-compliant components retired by 21 September 2029.

Partitions on FIPS 140-3 Level 3 hardware*
RBI
Digital payment security & tokenisation

The Master Direction on Digital Payment Security Controls (2021) expects strong key management, and card-on-file tokenisation has applied since 1 October 2022.

Token-vault and data keys in hardware
SEBI
CSCRF (20 August 2024)

The Cybersecurity and Cyber Resilience Framework covers encryption and key management for regulated entities, scaled by category.

Quorum, logs and key location as evidence
PCI DSS
v4.0.1 (June 2024)

Future-dated requirements apply from 31 March 2025. Requirement 3 covers protecting stored account data and the keys that encrypt it.

Key custody and split control
CERT-In
Directions of April 2022

Incidents reported within 6 hours; ICT logs kept for 180 days within India.

HSM audit logs retained in India
DPDP
DPDP Act 2023 & Rules 2025

Reasonable security safeguards, including encryption, are expected for personal data.

Keys kept away from the data they protect

Checked October 2026 for orientation only — not legal advice. Your organisation stays responsible for its compliance; confirm current requirements with the CCA, RBI, SEBI, PCI SSC, CERT-In, UIDAI or the Data Protection Board.

Plans

Rent a partition, or let us run the cloud HSM you already have.

Same indicative prices as our HSM page. Connectivity is quoted for your clouds.

Cloud HSM partition

One partition, Mumbai HA

₹24,999/ partition / month*
  • Dedicated partition on FIPS 140-3 L3 hardware*
  • Mirrored across two HSMs in Mumbai
  • PKCS#11, JCE, CNG/KSP, KMIP, REST*
  • Audit log export to your SIEM
  • 24×7 monitoring included
Most asked for Partition + DR

Mumbai primary, DR replica

₹49,998/ month* · 2 partitions
  • Primary partition in Mumbai Tier IV
  • DR partition at a partner DC in India*
  • Wrapped-key replication between sites
  • Failover drills, logged
  • Quorum held by your custodians
Managed hyperscaler HSM

Your AWS / Azure / Google HSM, run by us

₹14,999/ HSM / month* ops
  • AWS CloudHSM, Azure Cloud HSM or Managed HSM, Google Cloud HSM
  • Health, capacity and audit alerts 24×7
  • Backups, client updates and DR drills
  • Provider usage billed by the provider
₹49,999*Key ceremony · one-time
₹29,999*Integration · per application
₹74,999PKI / CA HSM integration bundle · as on our PKI Software page
On quotePrivate link / IPsec, cross-connects, payment HSMs

* Indicative — confirm with XcellHost. INR, excluding 18% GST. The DR plan is two partitions at the partition price. Hyperscaler HSM usage is billed by the provider at actuals.

Configure

Size your Cloud HSM. See the rupee total.

Fixed-price items go to the cart. Connectivity and hyperscaler usage come with a quotation.

1 · Where the HSM runs
4 · HA / DR
5 · Clouds that will call the HSM connectivity quoted
6 · Services
Your estimate · indicative

Cloud HSM · 2 partitions

    Monthly₹0
    One-time₹0
    Subtotal · first invoice₹0
    GST (18%)₹0
    Total incl. GST₹0
    * Indicative — confirm with XcellHost. INR excl. 18% GST. Connectivity and hyperscaler usage are quoted or billed separately.
    Tool · 3-year TCO

    Cloud HSM vs on-prem HSM over three years.

    Illustrative. Appliance prices are on quote from the OEM, so you enter them. Every assumption is editable and the formula is shown.

    Workload
    On-prem assumptions · enter your own
    3-year total · excl. GST · illustrative
    Cloud HSM₹0
    On-prem HSM₹0
    Difference₹0—
      Formula cloud = partitions × (1 + DR) × ₹24,999* × 36 + ceremony ₹49,999* + apps × ₹29,999* appliances = max(2, ⌈partitions ÷ per appliance⌉ + 1) × (1 + DR) on-prem = appliances × (price + price × support% × 3 + rack × 36) + staff hrs × rate × 36 + ceremony + apps × ₹29,999*
      Illustrative only, not a quotation. Defaults are placeholders for you to replace. Excludes connectivity, hyperscaler usage, tax and financing.
      Tool · which key-control model?

      Four questions. BYOK, HYOK, EKM or dedicated?

      One question at a time. Go back any time; the result explains itself.

      Question 1 of 4

      —

      Recommended model

      Answer the questions

      Your answers are scored against four models. Nothing is sent anywhere.

        Compare

        Cloud KMS, hyperscaler HSM or XcellHost Cloud HSM?

        Who generates the keyThe provider, or you by importYou, inside your HSMYou, inside your partition
        Where it physically isA region of that cloudA region of that cloudA named Mumbai facility + DR in India*
        Serves other cloudsNoMostly its own cloudYes, over private link or IPsec
        Standard crypto APIsProvider APIPKCS#11, JCE, CNG and morePKCS#11, JCE, CNG/KSP, KMIP, REST*
        Quorum & ceremonyIAM policiesYou run it yourselfRun with you, witnessed and recorded
        BillingPer key and requestHourly, in the provider's currencyMonthly INR invoice with GST
        Getting started

        From workshop to first signature in about two weeks*.

        1. 01
          WorkshopKeys, clouds, regulators and the key-control model you need.
          Day 1–2*
        2. 02
          Design & quotePartitions, HA/DR, private-link or IPsec paths and roles agreed.
          Week 1*
        3. 03
          ConnectPrivate link or IPsec from each cloud and DC; client libraries installed.
          Days*
        4. 04
          CeremonyPartition initialised, quorum cards issued, first keys created on record.
          1 day*
        5. 05
          IntegrateCA, databases, signing or BYOK/HYOK flows tested in staging, then production.
          1–2 weeks*
        6. 06
          Run24×7 monitoring, monthly report, DR drills and log retention.
          Ongoing