Encryption & Key Management
Encrypts data and manages keys/HSMs.
Overview
This area covers data-at-rest/in-transit encryption, enterprise key management, and hardware security modules for key custody. It protects confidentiality and meets regulatory mandates. Cloud KMS is inexpensive per key; dedicated HSMs and key-management platforms carry appliance/license cost. Tokenization and BYOK/HYOK are common requirements.
Protects data confidentiality and meets regulatory mandates.
Advantages
- Cloud KMS is cheap and easy
- Thales/Entrust HSMs are compliance-grade
- Vault flexible
- supports BYOK/HYOK.
Trade-offs
- Key-management complexity
- HSM capital cost
- performance trade-offs
- lost-key and availability risk.
Open-source option
HashiCorp Vault and OpenSSL already gave this area genuine self-hostable options; OpenBao — the Linux Foundation's MPL-2.0 fork of Vault, created after HashiCorp moved Vault to a non-OSI Business Source License in August 2023 — adds a credible, truly-open alternative for teams who want Vault's model without the BUSL terms.
Vendors & tools in this area
Google Cloud's managed key management and HSM service — the GCP counterpart to AWS KMS/Azure Key Vault, missing from this area until now.
Visit site →Linux Foundation-governed, MPL-2.0 fork of Vault — the truly open-source continuation after HashiCorp's 2023 BUSL relicense.
Visit site →