Generate, store and use cryptographic keys inside certified, tamper-resistant hardware. Manage on-premises, cloud and hybrid environments under one key policy with the Security World architecture.
Pricing is prepared per project, based on model, performance licence, redundancy and support term.
Network appliance, in-server card or as a service: all three share the same Security World key management.
Rack-mounted appliance serving many applications over the network in your data centre.
A card installed in a single server for applications that need low-latency cryptography.
Dedicated HSM capacity in Entrust data centres without buying hardware.
Outside the HSM, keys exist only in encrypted form; authority to use them stays with you through cards and quotas.
Keys are generated by the certified hardware's true random number generator and never leave in plain text.
Security World backs keys up as encrypted files; every HSM in the same world can use them.
Administrator and operator card sets enforce a k-of-n quorum so critical operations need several people's approval.
Hardware audited through FIPS 140-3 Level 3 and Common Criteria evaluations.
With BYOK and HYOK you keep control of keys even for cloud workloads.
Run your own sensitive code inside the HSM's protected environment.
A migration path to new NIST algorithms through software updates.
PKCS#11, CNG/KSP, JCE and OpenSSL interfaces for common PKI, database and application integrations.
Authenticated remote management and monitoring without a trip to the data centre.
Anywhere a key must never reach a server in plain text: from root certificates to payment systems.
Generation, storage and signing ceremonies for root and issuing CA keys.
Keys for software, drivers, e-documents and electronic signatures protected in hardware.
Private keys of load balancers and web servers made non-exportable.
TDE master keys for Oracle, SQL Server and other systems kept in the HSM.
Cryptographic operations for card data protection, PIN and tokenization.
Bring your own key (BYOK) and key sovereignty on AWS, Azure and Google Cloud.
Level and scope depend on the selected model and firmware version. We confirm your model's current certification status in writing with the quote.
A hardware security module that generates, stores and uses cryptographic keys inside tamper-resistant hardware. Keys never reach the server in plain text; signing and decryption happen inside the HSM.
nShield 5c if several applications will use the HSM over the network, nShield 5s for low latency in a single server, and nShield as a Service if you do not want to manage hardware. Share your use case and we will decide together.
The nShield 5 family is designed to move to post-quantum algorithms through software updates. Supported algorithms and versions are stated in the quote for your model.
Yes. We provide on-site or remote support for installation, Security World creation, card set preparation and key ceremonies.
A project-specific quote is prepared based on model, performance licence, redundancy (single unit or cluster), support term and add-on modules.
Share your use case, transaction volume and compliance needs; we will send a quote and architecture proposal within one business day.