> Labs_
Back

OVHcloud Cloud HSM

Keep your cryptographic keys in HSM custody, without operating HSM hardware.

Request beta access All experiments
Status
Beta
Category
Network & Security
Access
Open
Release date

Key facts

Beta
closed, starts Dec 15, 2026, on request
Where
Paris, Milan, Roubaix, Gravelines, Strasbourg
Price
free during Beta

Discover OVHcloud Cloud HSM

With OVHcloud Cloud HSM, you get your own cluster of HSM partitions, without operating HSM hardware. Use your keys through our PKCS#11 driver, and let OVHcloud handle HSM initialization and key replication across the partitions.

Key benefits:

  • Keys stay in the HSM. Keys are created and kept inside the HSM boundary; plaintext key material never leaves it.
  • A fixed, resilient cluster. Every cluster is three partitions on three different physical HSMs, placed by OVHcloud from the primary region you choose.
  • Access checked on every operation. Mutual TLS on every connection, and an IAM authorization check before each cryptographic operation.
  • One stable PKCS#11 driver. Your integration keeps working whatever HSM vendor runs underneath.
  • Performance. Up to 1,000 operations per second with RSA 2048 keys.

What's an HSM?

A Hardware Security Module (HSM) is a dedicated, tamper-resistant hardware appliance designed to securely store, manage, and use sensitive cryptographic keys. They are commonly used in high-security or regulated environments, such as finance, government, and healthcare, where data protection is paramount. By providing a secure, certified and isolated environment for sensitive data, HSMs help prevent unauthorized access, tampering, and data breaches while helping your infrastructure meet the most demanding compliance requirements.

OVHcloud HSM offers

OVHcloud is introducing a range of HSM offers to cater to different customer needs. Our HSM offerings include:

  • KMS on HSM: A mutualized, fully managed by OVHcloud HSM solution.
  • Cloud HSM: A cluster of three dedicated HSM partitions, with high availability managed by OVHcloud
  • Dedicated HSM: A dedicated HSM appliance for customers with the highest compliance requirement

Simplified management

Focus on cryptographic key management without the hassle of configuring the HSM itself. Initialization, high availability and monitoring are fully managed by our dedicated team.

HSM vendor selection

At OVHcloud, we prioritize sovereignty by partnering exclusively with European vendors that meet the highest security standards, including EAL4+ and FIPS 140-3 level 3 certifications. To ensure maximum flexibility and control, we've designed our system and infrastructure to be vendor-agnostic.

For the initial deployment of our Cloud HSM offer, we've selected Thales Luna HSM as our partner in the first regions to be rolled out.

How does it work?

Direct usage of HSM partitions

Your application works with the HSM cluster through the OVHcloud PKCS#11 driver: sign and verify, encrypt and decrypt with RSA, ECDSA and AES keys, and unwrap or import wrapped keys. Every connection is authenticated with mutual TLS, each cryptographic operation is checked against your IAM policies first, and security events go to Logs Data Platform.

Simplified HSM Management

Create your HSM cluster and choose its primary region: OVHcloud automatically deploys your partitions in a fixed set of locations tied to that region. No topology to design, no placement to manage. Just pick the region closest to your workload, and let OVHcloud handle the replication of all cryptographic assets across the cluster.

Endpoints and failover

Each availability zone exposes its own public endpoint: connect to the one closest to your workload. If an endpoint becomes unavailable, open a new PKCS#11 session on another one; your keys remain valid. The HSM Abstraction Layer hides the complexity of managing the HSM, which keeps the service vendor-agnostic: you use the same PKCS#11 driver whatever the underlying HSM vendor or technology.

Product lifecycle

  1. Alpha

    Restricted access. Closed-group testing with early customers.

  2. Beta

    Closed beta from December 15, 2026, on request: a limited group of customers integrates Cloud HSM through PKCS#11 and shares feedback before GA.

  3. General Availability

    In production. Stable and in the OVHcloud catalogue.

What’s next on the roadmap?

Upcoming features:

  • OVHcloud KMS integration: Use your Cloud HSM as a backend when creating a key with OVHcloud KMS, so every OVHcloud product compatible with OVHcloud KMS can use a key kept on your own Cloud HSM.
  • Private endpoint: Connect to your cluster through a VPC private endpoint, in addition to the public endpoints.
  • More regions: Cloud HSM opens in each new region as soon as it is equipped with HSMs.
  • Dedicated HSM: Dedicated appliance for the highest compliance requirements

The roadmap for OVHcloud Data Security is available on GitHub: https://github.com/orgs/ovh/projects/16/views/11

Questions, answered.

Pricing will be per Cloud HSM cluster per month, without any additional fees.

Cloud HSM runs on Thales Luna HSMs.

Cloud HSM will be available in Paris, Milan, Roubaix, Gravelines and Strasbourg to start with. Our ambition is to bring HSMs to every OVHcloud region, and Cloud HSM will open in each one as it is equipped.

Shape what ships next.

Join the User Experience Program to test upcoming products, get early alpha and beta access, and put your fingerprints on the roadmap.

Join our UX program How it works