Bring management and control together.
Create, rotate, disable and retire keys. Manage permissions and policies centrally, with logs for follow-up.
See what KMS includesKMS & HSM / Data protection & key control
Your key control.On Swedish ground.
Control how your encryption keys are used and protected. Choose KMS, HSM and a control model for cloud, SaaS and your own systems.
- Public clouds
- SaaS
- Your own environment
Key service at CompliorKMS manages · HSM protects
Key service on Swedish groundKMS with HSM-based protectionControl based on your integration
Two parts of key protectionManage the keys.
Manage the keys.
Protect the foundation.
With KMS, you control the lifecycle and use of your keys. HSM protects key material and cryptographic operations in hardware. At Complior, these components can work together.
Protect key material in hardware.
A protected environment for uses such as signing, PKI and KMS keys. Choose your own partition, a dedicated unit or place your own HSM with us.
Compare HSM delivery modelsYour key policy.
We manage the platform.
Get a logically isolated customer environment in Thales CipherTrust Manager. Root and master keys are protected by an HSM.
Platform operations in Sweden
Complior handles monitoring, maintenance, upgrades and backups on our Swedish infrastructure.
Control over use
You set permissions, policies and key lifecycles. Management of your KMS environment can be agreed as an optional service.
Expand as needed
Add a dedicated KMS instance, cloud key management with CCKM, file encryption with CTE or support for integration and SIEM.
Components, licences, support and scope are specified for your service.
Start with your environmentMultiple environments.
Multiple environments.
The right control model.
Start with the services and systems you already use. See what key control each integration can provide.
PUBLIC CLOUDSCloud services.
Cloud services.
Your choice of key control.
Keep the workload in the cloud and choose how the keys are managed. External key management and importing your own keys are two different models.
See the difference between BYOK and HYOK- AWS XKS
- AWS KMS sends cryptographic requests to the external key service at Complior.
- Azure BYOK
- Your own key material is imported into Azure Key Vault or Managed HSM and used there.
- Google Cloud EKM
- Supported services connect to an external key manager through CipherTrust.
SAAS
Key control where you collaborate.
Protect selected information flows with a connected key service. The data covered and the effects on collaboration, search and clients depend on the solution.
Explore information protection with NC Protect- Google Workspace CSE
- Client-side encryption with external key management for the features and licences that support CSE.
- SharePoint with NC Encrypt
- NC Encrypt Connector connects information protection to Complior KMS.
- Salesforce
- CipherTrust supports integrations. The key model and licence are selected to suit the service.
YOUR OWN ENVIRONMENT
Central management for your systems.
Connect storage, databases and applications to centralised keys and policies. The choice of interface and encryption component is based on the systems you have.
We test product support, client versions and recovery. KMIP can distribute keys to authorised clients.
- KMIP
- Key management for compatible storage, backup and virtualisation systems.
- REST API
- Integrate key functions into your own applications.
- CipherTrust Transparent Encryption
- CTE provides agent-based file encryption for supported servers, with centralised keys and policies.
COMPLIANT CLOUD
Plan protection alongside the platform.
For systems on Complior's infrastructure, key management can be planned alongside the platform, backup and operations.
Explore Compliant Cloud- Systems and data
- Choose encryption components to suit your applications and data volumes.
- Separate roles
- Separate system administration from permission to manage and use keys.
- Coordinated recovery
- Plan and test that keys and backed-up data can be restored together.
The integration determines the scope. We verify the service, region, licence, version, response times and recovery. Complior operates the key platform. Responsibility for your applications and external cloud and SaaS environments follows your other provider agreements.
Where is the key material?
Your own keys can be used in different ways. An important distinction is whether key material is supplied to the cloud service or held in an external key service.
BYOK · Bring Your Own Key
The key is used within the cloud service.
You supply your own key material to a supported cloud service and can control parts of its lifecycle.
Outside the cloud serviceYour key source
Cloud service environmentKey materialData & application
HYOK / external key service
The key is held outside the cloud service.
Key material is held in an external key service, used through a supported integration.
External key serviceKey material
Cloud service environmentData & application
Two conceptual diagrams. An external master key can protect data keys used within the cloud service. The integration determines key location, where operations take place and the control you have. Key control is one part of data protection.
What we verify for your integration
BYOK
- Import, copies, rotation and deletion of key material.
- Which parts of the lifecycle you can control. BYOK does not in itself mean that key material remains outside the cloud.
External key service
- Which operations take place externally and how any caches work.
- What happens if the connection is lost and how the solution is restored.
Hardware protection / Thales HSM
HSM as a service.
Protect keys for PKI, signing and applications with Thales HSM in Swedish data centres.
You choose the delivery model. We support you with hardware operations under your agreement.
Which delivery model suits you?
Three models. The same Swedish foundation.
Conceptual diagrams of the delivery models. Operations, redundancy and service levels depend on the chosen model and agreement.
Complior takes care of the hardware.
Physical environment, monitoring and maintenance according to the chosen delivery model.
You control how the keys are used.
Key policies, permissions and integration with your applications.
Compare operations, redundancy and responsibilities
Private partition
You activate your logical partition. It is synchronised with a partition in a geographically separate Swedish data centre. Complior manages the hardware under the agreement.
Dedicated HSM
Complior monitors, maintains and manages the physical device. Backup and clustering can be added according to your needs.
Your own HSM
You own the equipment and place it in our Swedish data centres. Monitoring and maintenance are arranged as agreed.
Key management roles and procedures are documented during implementation. The model, capacity, support and service level are established in the agreed service.
Connectivity, technology and implementation
Connect where you are
From your own environment, another provider or Compliant Cloud. An HSM client and an interface such as PKCS#11 connect the application to the hardware protection.
HSM can protect root and CA keys for PKI, keys for digital signing and code signing, and serve as a root of trust for applications and KMS.
We verify the solution
- HSM client, interfaces and algorithms.
- Capacity, response times, networking and authentication.
- Backup, recovery and redundancy for the chosen model.
- HSM model and certificate scope against your requirements.
From requirements to operations
- Choose a model and document responsibilities and key policy.
- Set up and connect the HSM environment.
- Verify functionality, performance and recovery.
- Review procedures and, where needed, the key ceremony.
Responsibility & controlControl that holds up
Control that holds up
in everyday use.
Decide who can do what and how the work will be followed up. We help you plan responsibilities and procedures from implementation through ongoing management.
See responsibilities and assessment evidence- 01
Define responsibilities and permissions.
Map your systems and decide who may administer the platform, manage keys and approve sensitive actions. Responsibilities and support arrangements are documented as part of the service.
- 02
Configure policy and lifecycle.
Set up the selected connections and procedures for creation, use, rotation and retirement. Retain keys needed for older data and backups.
- 03
Verify in a pilot.
Test functionality, response times, outages and recovery before implementation. The availability of the key service can affect access to protected information.
- 04
Hand over and follow up.
Train administrators and hand over procedures to the operations team. Agree on logs, follow-up and evidence for review.
Frequently asked questions
Before you choose.
Are KMS and HSM the same thing?
No. KMS provides functions for managing keys and their lifecycle. HSM provides a protected hardware environment for key material and cryptographic operations. A KMS can use HSM as part of its protection.
Does our data have to move to Complior?
Key control can be used for data in other environments through supported integrations. We need to assess the specific service and data type. Connecting a key service is not the same as moving the workload itself.
Do all keys remain in Sweden?
It depends on the control model. Complior's key service has a Swedish foundation, but BYOK may involve importing key material to a cloud provider. Location, copies and use must be described for each integration.
Can we disable access by blocking a key?
Blocking a key can stop future key use to the extent supported by the integration. The effect depends on factors including caching, already decrypted data and application behaviour. The process needs to be verified before implementation.
Can we have a dedicated KMS environment?
The core service provides a logically isolated customer environment in Complior's CipherTrust platform. A dedicated KMS instance is available as an option. This is a separate choice from a dedicated physical HSM; we size the components to meet your needs.
Key control in practiceScrive.
Scrive.
Cloud and keys
with different providers.
Scrive holds its external root keys with Complior, outside AWS. With Sovereign Keystore, key control has a separate location from the cloud service.
Read the Scrive case studyRead Scrive's own description
Next stepsWhere do you need
Where do you need
greater key control?
Start with your most important systems and the information you want to protect. Together, we develop a proposal for the control model, integration and responsibilities.
A GOOD START TO THE CONVERSATION
- Where is the information today?
- What control do you need to demonstrate?
- Which systems must keep working during an outage?