Platform
An HSM workflow, not a key-value store.
SanctiKey exposes a complete cryptographic toolkit over a single REST API: generate keys, sign, encrypt, run a certificate authority, escrow for recovery, and federate it all into your identity provider. The key material stays inside AWS KMS HSMs, FIPS 140-3 Security Level 3 validated (CMVP certificate #4884), in your own AWS account; the API returns results, never bytes.
Every capability below ships to every account. You can read why we built it this way or the full security model.
The isolation model
Everyone else makes you a row in their database. We give you an account of your own.
The industry default
One control plane, every tenant
- Your keys are records in a service that also holds everyone else’s.
- A bug in the vendor’s tenancy check is a bug in your isolation.
- Audit trails interleave every tenant, then get filtered back apart for you.
- Leaving means export ceremonies, if export is allowed at all.
SanctiKey
An AWS account per customer
- The account boundary is the wall: AWS’s strongest isolation primitive.
- Your keys, quotas, identity pool and audit table exist only inside it. There is no shared database with a
tenant_idcolumn, because there is no shared database. - Every operation lands in an audit trail that is yours alone.
- Exit is a first-class feature: the account, keys and history transfer to you.
The honest scoping, because you would find it anyway: the FIPS 140-3 Level 3 boundary is the AWS KMS HSM fleet (CMVP certificate #4884), which is shared infrastructure operated by AWS. Key material is generated inside that boundary and never leaves it. What is dedicated to you is the AWS account and everything in it: the key policies, the IAM, the quotas, the audit trail, and the control plane that reaches them. We name the boundary that is actually yours rather than implying a rack with your name on it.
Cryptographic operations
The operations you came for
Sign & verify
ECDSA (P-256/384/521) and RSA signing over REST, with per-key usage policies, algorithm pinning, and text or file payloads.
Encrypt & decrypt
Envelope encryption with rotated, multi-region customer master keys. Encryption context is enforced on every call.
PKI & certificates
CSR signing, full certificate chains, root and intermediate ceremonies, issuance and revocation, with public CRL and OCSP endpoints. Driven from the REST API and the console; there are no enrollment protocols (no ACME, SCEP or EST).
Key escrow
Two-step confirmed escrow for break-glass recovery. No single action can ever move a key; both steps are independently audited.
Control & governance
The controls around them
Federation
SAML / OIDC into your existing identity provider, with MFA enforced wherever you require it. No second user directory to run.
Partitions
Named compartments for your keys, each backed by its own access group. A user only sees and uses the partitions they belong to.
Audit everything
Every operation emits a tamper-evident audit event, exportable to your SIEM. Gaps in the trail raise an alarm, not a shrug.
REST API & scoped keys
Everything above is one HTTPS call. Programmatic access uses scoped API keys with instant, cache-free revocation.
On the roadmap
Opt-in multi-region
Your keys are already multi-region-capable by default. The opt-in turns that into real presence in additional regions, for three reasons, not just one:
- →Disaster recovery: survive the loss of an entire region with a defined RTO, not a hope.
- →Latency: run operations against keys that live next to your workload.
- →Residency: keep key material in the region your compliance regime requires.
Standby
Your keys and data replicate to a second region; the serving stack spins up on failover. Recovery in hours, near-zero data loss.
Active
A full standby environment runs warm with automated health-checked failover. Recovery in minutes, plus scheduled failover drills with reports you can see.
You also get deterministic, long-lived per-region endpoints, so you can choose exactly which region performs a given operation. Each region is priced at its own marginal cost, so you pay only for the regions you turn on.
Not generally available yet. We’d rather list it as a roadmap commitment than sell it before it ships.
Same features for every account. Accounts differ by usage, never by safety.
The smallest plan ships the same modules, the same isolation, and the same capability set as the largest. You pay for volume, not for the right to be secure.