Key custody, governance and certificate authority · delivered as a service

Your keys live in an AWS account with exactly one tenant: you.

No shared database. No tenant_idcolumn. No multi-tenant control plane, because there isn’t one. Keys are generated inside FIPS 140-3 Level 3 validated HSMs and cannot be extracted. Not by you. Not by us.

If your keys live in your own AWS account, then whoever owns your AWS organization owns your keys. We hold them outside it, on a separate trust axis. Why not just use KMS?

No tiers. No calls. 100K operations a month included.