Data & Cryptography

Keys, HSM & PKI

FIPS 140-3 Level 3 HSM clusters, key lifecycle to NIST SP 800-57, M-of-N ceremonies, certificates and post-quantum migration

HSM clusters

DC1 · DR · non-production cloud HSM

Certification

FIPS 140-3 L3

tamper-responsive

Operations · 24 h

8.4 M

sign 62% · unwrap 31% · other 7%

Quorum for admin

2 of 3

smart cards held by custodians

Nodes

Node	Cluster	Partitions	Load	Latency p95	Firmware	Health
hsm-dc1-a	DC1	prod-general, goaml-signing, pki-root (offline)	41%	2.1 ms	v7.8 (PQC enabled)	Healthy
hsm-dc1-b	DC1	mirror of hsm-dc1-a	39%	2.0 ms	v7.8 (PQC enabled)	Healthy
hsm-dr-a	DR	prod-general, goaml-signing	12%	2.4 ms	v7.8 (PQC enabled)	Healthy
hsm-dr-b	DR	mirror of hsm-dr-a	11%	2.4 ms	v7.7	Warning
cloud-hsm-np	Non-production	dev, test	6%	6.0 ms	managed	Healthy

Open-source path: OpenBao for secrets and transit encryption with SoftHSM in non-production, step-ca or EJBCA for certificates. Hardware HSMs from any vendor connect over PKCS#11, KMIP or REST through Integrations.