Key custody, governance and your own private CA · delivered as a service
Your keys live in an AWS account with exactly one tenant: you.
No shared database. No tenant_id column. No multi-tenant control plane, because there isn’t one. Keys are generated inside FIPS 140-3 Level 3 validated HSMs and cannot be extracted. Not by you. Not by us.
Whoever owns your AWS organization owns the keys inside it. We hold yours outside it. Why not just use KMS?
No tiers. No calls. The base subscription is $99 a month with one key and 100K operations included.
One API, four operations
Requests go in, results come back, the key stays where it was made.
- sign
- The signature comes back. The private key that produced it never leaves the account.
- verify
- Check a payload against the key that signed it and get a verdict, not key material.
- encrypt
- Ciphertext comes back, under a key that stays where it was generated.
- issue cert
- Submit a CSR, get an issued and chained certificate from a CA that is yours.
The isolation model
Everyone else makes you a row in their database. We give you an account of your own.
The industry default
One control plane, every tenant
- Your keys are records in a service that also holds everyone else’s.
- A bug in the vendor’s tenancy check is a bug in your isolation.
- Audit trails interleave every tenant, then get filtered back apart for you.
SanctiKey
An AWS account per customer
- The account boundary is the wall: AWS’s strongest isolation primitive.
- Your keys, quotas, identity pool and audit table exist only inside it. There is no shared database with a
tenant_idcolumn, because there is no shared database. - Exit is a first-class feature: the account, keys and history transfer to you.
The FIPS 140-3 Level 3 boundary is the AWS KMS HSM fleet, which AWS operates and shares; what is dedicated to you is the account and everything in it. Read the honest scoping.
Compare
The two questions a buyer asks before ours gets answered.
Why not just use KMS?
KMS in your own account puts the key on the same trust axis as the data and the organization that holds it. This is what a separate axis buys you, and what it costs.
Read the comparison →
vs AWS Private CA
A CA priced per certificate authority per month against one that ships roots, chains, issuance, revocation, CRL and OCSP inside the base subscription.
Read the comparison →
Same features for every account. Accounts differ by usage, never by safety.
Run a real operation against a real key before you decide, or read what the bill looks like at your key count.
The demo is a shared evaluation environment on published demo terms; your demo account in it is deleted after 14 days.