🔑
Key types & algorithms
Asymmetric keys
RSA-2048, RSA-3072, RSA-4096
ECC P-256 (secp256r1), P-384 (secp384r1)
Symmetric keys
AES-128, AES-192, AES-256
HMAC-SHA-256 / SHA-384 / SHA-512
Signing algorithms
RSA PKCS#1 v1.5, RSA-PSS
ECDSA with SHA-256 / SHA-384
Encryption algorithms
RSA-OAEP (SHA-256)
AES-CBC, AES-GCM
Key agreement
ECDH key derivation (P-256, P-384).
Random number generation
FIPS 140-2 validated hardware RNG inside the HSM.
⚙️
Cryptographic operations
Key lifecycle
Generate, list, read public key, delete
Scheduled rotation with configurable grace period
Stable
key_id survives rotationSign & verify
Digest-input signing inside the HSM; verification by public key without HSM round-trip.
Encrypt & decrypt
Bytes-level RSA-OAEP and AES-CBC / AES-GCM. Plaintext never persisted outside the calling request.
Envelope encryption
HSM-managed KEKs wrap caller-provided DEKs. Wrapped DEKs stored anywhere; KEK never leaves the HSM.
Key extraction
Private keys cannot be exported as plaintext under any operation. Public material is exportable on demand.
🔌
APIs & integration
REST API
JSON over HTTPS. Bearer-token auth. Idempotent operations with request-id correlation.
MCP server
Nine HSM-backed primitives for AI agents
kms_create_masterkey, kms_sign, kms_verifykms_encrypt, kms_decrypt, kms_ecdhList, read public key, delete
PKCS#11 driver
Available for dedicated HSM plans; works with standard PKCS#11 clients.
Web console
kms-console.cloakapps.com — key listing, rotation policy, audit log, credential management.
Authentication
Keycloak-backed identity. Per-agent scoped credentials. Instant revoke and rotate.
📜
Audit, receipts & observability
Operation receipts
Every state-changing operation returns a signed JWS receipt — verifiable offline against the Cloak KMS public key.
Audit log
Tamper-evident, append-only log of every key operation. Filter by key, time range, principal.
Retention
12 months on shared plans; configurable up to 7 years on dedicated plans.
Export
CSV and JSON export from console; programmatic pull via audit API.
🏗️
Deployment tiers
Software keys
Encrypted key store, REST + MCP API, full audit log. 10,000 API calls/month.
HSM shared
Keys generated in shared HSM with logical tenant isolation. Private keys never extracted as plaintext. 100,000 API calls/month.
HSM dedicated
Dedicated hardware partition, physical tenant isolation, custom key policy, support terms by agreement. 500,000 API calls/month.
On-premise
HSM appliance deployed in customer data centre. Same API surface as cloud. Available on enterprise contract.
🛡️
Compliance & security posture
HSM certification
Underlying HSM modules are FIPS 140-2 Level 3 certified.
Frameworks supported
SOC 2 — control evidence ready
ISO/IEC 27001 — control mapping available
MAS TRM — key custody controls
PDPA / GDPR — data-residency options on dedicated plans
Transport security
TLS 1.3, mTLS optional on dedicated plans.
Tenant isolation
Logical isolation on shared plans; physical HSM partition on dedicated plans.
Backup & recovery
Encrypted key-backup blobs sealed to HSM; restoration only possible inside an authorised HSM cluster.
📈
Limits & service levels
Latency (typical)
Sign / verify < 80 ms p50. Encrypt / decrypt < 60 ms p50 from same region.
Throughput
Burst up to 200 ops/s on shared plans; sustained rates on dedicated plans per contract.
Availability
No uptime percentage is committed on self-serve plans. Availability commitments are agreed per contract on dedicated plans.
Regions
Singapore (primary). Additional regions available on dedicated plans.
Support
Email support on shared plans. Support channels and response targets on dedicated and enterprise plans are defined per contract.