# Virtual HSM {% hint style="info" %} This documentation is a work in progress and subject to updates and revisions. Keep an eye out for version changes and new additions to ensure you have the latest information. {% endhint %} ## Introduction Hardware Security Modules (HSMs) have emerged as indispensable components in safeguarding sensitive data and cryptographic operations. These dedicated hardware devices provide a highly secure environment for generating, storing, and managing cryptographic keys. As the digital landscape becomes increasingly complex and vulnerable to cyber threats, the need for robust HSM solutions has grown exponentially. While HSMs offer numerous advantages, including physical security, access controls, and performance enhancements, they also present unique challenges, particularly in the context of cloud computing. One of the primary limitations of HSMs is their reliance on physical hardware, which can make it difficult to migrate them to cloud environments. Unlike software-based security solutions that can be easily moved to the cloud, HSMs require specialized hardware that is typically deployed on-premises. This makes it challenging to achieve the same level of flexibility, scalability, and cost-effectiveness that cloud-based solutions often offer. Moreover, migrating HSMs to the cloud can involve significant technical and logistical challenges. Organizations may need to establish secure connections between their on-premises HSMs and cloud-based systems, ensuring that sensitive data is protected during transit. Additionally, there may be regulatory and compliance considerations to address, as well as potential security risks associated with cloud-based HSM deployments. ## enclaive Virtual HSM A virtual HSM (vHSM) combines the robust security of hardware-based solutions with the flexibility of confidential virtualization. Virtualization enables seamless integration and migration within complex cloud environments, ensuring scalability, elasticity, high performance, and availability. At the same time, the vHSM employs advanced encryption mechanisms, including 3D encryption, to enhance security, ensuring that neither the cloud provider nor any unauthorized entity can access sensitive keys. Essentially, the security architecture of a vHSM mirrors that of a traditional HSM, with the key distinction being that physical hardware security is replaced by encryption and confidential virtualization technologies. Technically, the vHSM runs enclaive [Vault](https://app.gitbook.com/o/u3yTMU8vRj5QnT6MPkEF/s/ZAOyClhisJhRvjIxLjXP/) and [Nitride](https://app.gitbook.com/o/u3yTMU8vRj5QnT6MPkEF/s/B6wCdvkxdUdtHHcfqQVl/) in [Buckypaper](https://app.gitbook.com/o/u3yTMU8vRj5QnT6MPkEF/s/JCiJp92CK5rDzO9DECIa/) Virtual Machines.

### Features


Elastic Secret Provisioning
Identity Management
Credential-based Access Control
Multi-cloud support, incl. AWS, Azure and GCP
3D encrypted: in-use, at-rest, in transit
High available RAFT cluster
NIST FIPS 203, FIPS 204 and FIPS 205 Post-Quantum Cryptography support
#PKCS11 HSM integration for secret unsealing and randomness provisioning
Supports compliance with standards like GDPR, C5, ISO 27001, and NIST 800-53

## Getting started {% content-ref url="documentation" %} [documentation](https://docs.enclaive.cloud/virtual-hsm/documentation) {% endcontent-ref %} {% content-ref url="tutorials" %} [tutorials](https://docs.enclaive.cloud/virtual-hsm/tutorials) {% endcontent-ref %} ## Learn more


Enclaive Multi Cloud Platform	Confidential Multi Cloud Platform
Virtual HSM	Hardware graded key, identity and workload management
Vault	Key, identity and access management
Nitride	Workload identity and access management
Buckypaper	Confidential Virtualization
Dyneemes	Confidential Kubernetes