Encryption is only as strong as the place the key lives.
A hardware security module is a hardened, tamper-resistant appliance — or a card, a USB device or a cloud service built on the same hardware — that generates keys with a true random source, stores them inside a protected boundary and performs signing, encryption and key wrapping there. Applications send data in and get results back; the private key itself is never handed out. Tamper sensors erase key material if the casing is attacked.
XcellTrust HSM brings this to Indian banks, NBFCs, payment companies, certifying authorities, SaaS providers and government teams as a complete service: we help you choose the right type and certification, procure from leading HSM OEMs*, rack it in our Mumbai Tier IV data centre or yours, run the key ceremony, connect your applications and watch it 24×7 with tested DR. Prefer not to own hardware? Take a dedicated partition as HSM-as-a-Service.
What a modern network HSM gives you.
Typical of the general-purpose network HSMs we deploy. Exact capacity, algorithms and certificates depend on the OEM model and firmware*, and we confirm them in your quotation.
One appliance split into many cryptographically separate partitions, each with its own keys, users and policies — one per application or tenant.
Dedicated crypto processors for RSA, ECC and bulk AES, so signing and encryption keep pace with production traffic.
Keys come from an on-board hardware random number generator with health checks, not from an operating system pool.
Administrators manage the box but cannot use keys; key users cannot change policy. Two-factor admin login with smartcards or PIN-entry devices.
Every key and admin event is logged and can be signed, then streamed to your SIEM for review.
PKCS#11, Java JCE/JCA, Microsoft CNG/KSP, OpenSSL engine or provider, KMIP and REST — most software connects without code changes.
Keys backed up only in wrapped form to another HSM or backup token; HA groups balance load and fail over between appliances.
Newer firmware on many models adds NIST's ML-KEM, ML-DSA and SLH-DSA (FIPS 203, 204 and 205)* for testing and migration.
India's Controller of Certifying Authorities asks the PKI ecosystem to use SHA-2 (not SHA-1 or MD5) for new signatures and hashes. We configure HSM policies so deprecated algorithms cannot be used to sign.
Simplified, OEM-neutral view. Some models add a PIN-entry device for administration, internal batteries for the real-time clock, or a separate management network.
Nobody holds every key. By design.
HSMs enforce separation of duties in hardware. We map these roles to named people in your organisation during the key ceremony.
Initialises the HSM, creates and deletes partitions, applies firmware and network settings. Cannot see or use any key.
Often: XcellHost operations, under your approvalOwns one partition: sets its policy, creates crypto users and controls backup. Cannot change the appliance.
Usually: your security teamThe application identity that creates, imports and uses keys to sign, encrypt or unwrap. Cannot change policy.
Your CA, payment switch or appPlugs into the software you already run
- Health checks and self-tests at power-on and on demand
- Audit logs exportable to your SIEM or our SOC
- Windows and Linux client libraries; container and Kubernetes clients on many models*
Data-centre grade from the power supply up.
What to expect from the network appliances we rack. Values are typical; the OEM datasheet for your model is the reference, and we attach it to your quotation.
Dual redundant, hot-swappable power supplies on 100–240 V AC, so one feed or PSU can fail without downtime.
Two or more Ethernet ports, 1 GbE or 10 GbE, for bonding or separate client and management networks.
Client software for Windows Server and major Linux distributions; virtual and container platforms per OEM*.
1U or 2U rack-mount network appliance; PCIe cards and USB HSMs for single-server or offline use.
Built for normal data-centre temperature and humidity ranges; ours run in a Tier IV hall with monitored power and cooling.
OEM safety, EMC and environmental marks such as RoHS vary by model and are listed on the datasheet*.
Four ways to get an HSM. Pick by workload, not brochure.
General-purpose HSMs protect PKI, signing and encryption keys. Payment HSMs speak the card and PIN protocols banks need. Cloud HSMs and HSM-as-a-Service remove the hardware from your books.
| On-prem general-purpose | Payment HSM | Hyperscaler cloud HSM | XcellHost HSM-as-a-Service | |
|---|---|---|---|---|
| Best for | CA root keys, code signing, TDE, eSign, custom crypto | PIN, card issuance, EMV, ATM/POS, UPI back-ends | Workloads already on AWS, Azure or Google Cloud | Indian teams that want a dedicated partition without buying hardware |
| Form | Network appliance, PCIe card or USB | Network appliance with payment firmware | Managed service in the provider's region | Partition on HSMs in our Mumbai Tier IV DC |
| Where keys live | Your rack, or ours under your control | Your rack, or ours under dual control | Provider's data centre, chosen region | Mumbai, with DR copy you approve |
| Typical certificates | FIPS 140-3 L3*, CC EAL4+*, eIDAS QSCD* | PCI PTS HSM*, FIPS 140* | FIPS 140 L3 per service* | FIPS 140 L3 hardware* |
| Interfaces | PKCS#11, JCE, CNG/KSP, KMIP, REST | Host command set over TCP/IP | PKCS#11, JCE, CNG/KSP, OpenSSL, cloud API | PKCS#11, JCE, CNG/KSP, KMIP, REST* |
| Cost model | Capex + support, on quote | Capex + support, on quote | Hourly usage, billed by provider | From ₹24,999* / partition / month |
| Who runs it | You, or XcellHost managed ops | You, or XcellHost managed ops | Provider runs hardware; you run keys | XcellHost 24×7; you own keys and policy |
OEMs we work with include leading HSM vendors such as Thales (Luna, payShield), Entrust (nShield), Utimaco, Marvell (LiquidSecurity) and Fortanix*. *Partner status to be confirmed; names are trademarks of their owners and shown as text only.
What the badges on an HSM actually promise.
Certificates belong to a specific model and firmware version. Always check the certificate number, not the brochure — we do this for every unit we supply.
The US/Canadian Cryptographic Module Validation Program (CMVP) tests crypto modules at four levels. Level 3 adds tamper response that zeroises keys and identity-based authentication — the usual bar for CA and payment keys.
An international (ISO/IEC 15408) evaluation of a product against a protection profile. EAL4+ means methodically designed, tested and reviewed, with extra assurance components. Required by many governments and for eIDAS.
Check which protection profile was used — for signing HSMs in Europe that is usually EN 419 221-5.The PCI Security Standards Council's device standard for payment HSMs that handle PINs and card keys. Version 4.0 (December 2021) added a class for cloud-based, remotely managed HSMs; v3.0 closed to new evaluations in 2022.
Needed for PIN processing under PCI PIN and expected by card networks for issuance and acquiring.Under the EU eIDAS regulation, a Qualified Signature Creation Device is required for qualified electronic signatures. Remote-signing services use HSMs certified to Common Criteria protection profiles such as EN 419 221-5.
Relevant if you issue or rely on EU qualified signatures; Indian eSign follows CCA rules instead.Summaries checked October 2026 against NIST CMVP, the CCA advisory on FIPS 140-2 to 140-3 migration, PCI SSC and EU eIDAS material. Not legal advice; confirm with the certificate and your auditor.
Ten jobs an HSM does better than software.
Pick one to see the key it protects, what the HSM does and where to go next.
From sizing to 3 a.m. failover — one team.
Hardware is the easy part. Most HSM risk sits in procurement mistakes, undocumented ceremonies and untested backups. We handle all seven stages.
- SizingWorkloads, ops per second, algorithms, partitions, HA and DR — using the estimator below as a start.
- ProcurementModel and certificate matched to your regulator; OEM-neutral quotes, import and warranty handled.
- Rack & networkMumbai Tier IV DC in a monitored cage, or installed in your data centre by our engineers.
- Key ceremonyScripted, witnessed and recorded; M-of-N cards issued to your custodians; backups sealed.
- IntegrationCA, payment switch, databases, signing pipelines and apps connected via PKCS#11, JCE, CNG, KMIP or REST.
- 24×7 monitoringHealth, capacity, certificate expiry and audit events watched by our NOC and SOC.
- DR & drillsKeys replicated or backed up to a second site; restore and failover tested on a schedule.
Hosted HSMs sit in our Mumbai Tier IV data centre; DR location agreed with you.
01Your custodians keep the M-of-N cards. We operate the hardware, not your keys.
02Change control, access logs and evidence your auditors can sample.
03Alerts on health, tamper and audit events worked around the clock from Mumbai.
04We recommend the model your workload and regulator need, not the one with the biggest margin.
05Hardware, hosting, services and support on one GST invoice from an Indian company.
06HSMs help you meet what Indian regulators ask for.
An HSM is a control, not a certificate of compliance. Here is where it fits in the rules our customers work under.
CA signing keys must sit in certified hardware crypto modules. CCA's advisory sets the move to FIPS 140-3: no DSC issuance on FIPS 140-2 modules after 21 September 2026, full retirement by 21 September 2029.
Entities storing Aadhaar numbers must keep them in an Aadhaar Data Vault backed by an HSM (FIPS 140-2 Level 3 per UIDAI's FAQ), with signing and e-KYC decryption keys held inside the HSM.
RBI's Master Direction on Digital Payment Security Controls (2021) expects strong cryptographic key management. Since 1 October 2022, card-on-file data is replaced by tokens, with token vaults and card keys protected in HSMs.
Banks, PSPs and TPAPs follow NPCI's security requirements for UPI. Payment HSMs protect PIN handling, message signing and encryption keys in the switch.
SEBI's Cybersecurity and Cyber Resilience Framework (20 August 2024) applies to regulated entities by size. Its data-security controls cover encryption and key management, which an HSM evidences.
The current version (June 2024), with future-dated requirements in force from 31 March 2025. Requirement 3 covers protecting stored account data and the keys that encrypt it.
Incidents reported within 6 hours and logs kept for 180 days in India. HSM audit logs feed both, and our SOC keeps them.
Reasonable security safeguards, including encryption, are expected for personal data. Keys held in an HSM keep encrypted data unreadable if a database or backup leaks.
Checked October 2026 for orientation only — not legal advice. Your organisation remains responsible for its compliance; confirm current requirements with the CCA, UIDAI, RBI, NPCI, SEBI, PCI SSC, CERT-In or the Data Protection Board.
Rent a partition, or own the appliance. We run either.
Appliance prices depend on OEM, model, certificate and throughput, so hardware is always on quote. Service fees below are fixed and indicative.
Dedicated partition
- Isolated partition on FIPS 140 L3 hardware*
- Hosted in our Mumbai Tier IV DC
- HA across two HSMs, DR copy on request
- PKCS#11, JCE, CNG/KSP, KMIP, REST*
- You hold the partition credentials
- 24×7 monitoring included
Your HSM, run by us
- General-purpose HSM from leading OEMs*
- Racked in Mumbai Tier IV or your DC
- Key ceremony and quorum set-up
- Health, capacity & tamper alerts 24×7
- Firmware, backup and DR drills
- Monthly report and audit evidence
PIN, card & EMV
- PIN translation, verification, card issuance
- Dual control and split knowledge
- Connected to your switch or UPI stack
- Hosted under dual control or on-site
- Managed ops ₹14,999*/appliance/month
* Indicative — confirm with XcellHost. INR, excluding 18% GST. Hyperscaler cloud HSM usage is billed by the provider at actuals. The PKI / CA bundle price matches our PKI Software page; HSM hardware or service fees are extra.
Build your HSM setup. See the rupee total.
Fixed-price services go to the cart. Hardware, rack space and cloud usage come with a quotation.
HSM-as-a-Service · 2 partitions
How much HSM do you need?
An illustrative first pass. Capacity per partition and per appliance varies widely by OEM model, so both are inputs you can change. The formula is shown with the result.
load = ops/s × peak ÷ algorithm factor × 1.3
factors (assumed): RSA-2048 1 · RSA-3072 0.3 · RSA-4096 0.13 · ECDSA P-256 1.6 · AES/HMAC 4
partitions = ⌈load ÷ partition capacity⌉, × 2 with HA
appliances = ⌈load ÷ appliance capacity⌉ (+1 with HA, min 2) + DR copy
Five questions. One recommended type.
Answer for your main workload. The finder weighs your answers against the four HSM types and explains its pick.
Answer the questions
Each answer adds weight to one or more types. Unanswered questions are neutral.
HSM, software keystore or cloud KMS?
Cloud KMS services are often HSM-backed, but you share the hardware and the provider runs it. The difference matters when an auditor asks who could have touched the key.
| Question | Software keystore | Cloud KMS | HSM (dedicated or partition) |
|---|---|---|---|
| Where is the private key? | A file on a server, in backups and images | Provider-managed, often in shared HSMs | Inside a tamper-resistant boundary you control |
| Can an admin copy it? | Yes, with server access | Not directly; provider policy decides | No — non-extractable keys stay inside |
| Physical tampering | No protection | Provider's controls | Sensors erase keys on attack |
| Certificates | Depends on the library | Per service and region | FIPS 140-3 L3, CC EAL4+, PCI HSM per model* |
| Separation of duties | Operating-system permissions | Cloud IAM roles | Hardware roles plus M-of-N quorum |
| Payment PIN & card keys | Not acceptable | Generally not offered | Payment HSMs built for it |
| Key location for regulators | Wherever the server is | Chosen region | Your rack or our Mumbai DC, by name |
| Cost to start | Lowest | Low, usage-based | From ₹24,999*/month as a service |
Partition in days. Appliance in weeks.
Typical timings*. Appliance lead time depends mostly on OEM stock and import.
- 01WorkshopWorkloads, regulators, algorithms and current key locations reviewed.Day 1–3*
- 02DesignType, model, partitions, roles, HA and DR agreed; quotation issued.Week 1*
- 03ProvisionPartition created, or appliance procured, racked and networked.Days* · 3–8 weeks*
- 04CeremonyInitialisation, quorum cards and first keys under witness and recording.1 day*
- 05IntegrateApplications switched to HSM keys and tested in staging, then production.1–3 weeks*
- 06Run24×7 monitoring, monthly report, firmware and DR drills.ongoing