G2 takes pride in showing unbiased reviews on user satisfaction in our ratings and reports. We do not allow paid placements in any of our ratings, rankings, or reports. Learn about our scoring methodologies.
Egnyte combines the power of cloud content management, data security, and AI into one intelligent content platform. More than 22,000 customers trust Egnyte to improve employee productivity, automate b
Manage encryption keys on Google Cloud Platform
Azure Key Vault enables users to store and use cryptographic keys within the Microsoft Azure environment. Azure Key Vault supports multiple key types and algorithms and enables the use of Hardware Sec
Doppler is a centralized, secure secrets management platform tailored for DevOps engineers and CTOs at mid-market and enterprise companies. Secrets sprawl and fragmented processes can create significa
Akeyless is transforming the landscape of identity security by delivering the world’s first Unified Secrets & Machine Identity Platform, tackling the #1 cause of cybersecurity breaches—compromised
Oracle Cloud Infrastructure Key Management is a managed service that enables you to encrypt your data using keys that you control.
Keyfactor Command is a certificate lifecycle management solution that enables organizations to discover, control, and automate the lifecycle of keys and digital certificates across their IT landscape.
HashiCorp Vault tightly controls access to secrets and encryption keys by authenticating against trusted sources of identity such as Active Directory, LDAP, Kubernetes, CloudFoundry, and cloud platfor
With Box KeySafe, you have complete, independent control over your encryption keys, with no impact to the user experience.
AWS Key Management Service (KMS) is a service that help to create and control the encryption keys used to encrypt data, and uses Hardware Security Modules (HSMs) to protect the security of keys.
TokenEx is an enterprise-class tokenization platform that offers virtually unlimited flexibility in how customers can access, store and secure data. TokenEx works with multiple data-acceptance channel
Azure confidential computing offers solutions to enable the isolation your sensitive data while it's being processed in the cloud. Learn how to create and deploy applications based on confidential com
Salesforce Shield is a suite of products that provides an extra level of security and protection above and beyond what’s already built into Salesforce. Salesforce Shield capabilities help improve data
AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud.
OpenSSH provides tools that allows you to encrypt all traffic to help manage eavesdropping, connection hijacking, and other attacks to your Internet while providing secure tunneling capabilities and m
Secure data directly from your inbox with Virtru. Users can easily encrypt emails and attachments with just one click, protecting sensitive data such as personally identifiable information (PII), inte
SecureKey is a leading identity and authentication provider that simplifies consumer access to online services and applications.
GnuPG allows to encrypt and sign your data and communication, features a versatile key management system as well as access modules for all kinds of public key directories.
Vormetric is a data security platform that helps companies move and quickly to protect data wherever it resides any database, and application in any server environment.
Cloud HSM is a cloud-hosted hardware security module (HSM) service on Google Cloud Platform. With Cloud HSM, you can host encryption keys and perform cryptographic operations in FIPS 140-2 Level 3 cer
Device Authority is a global leader in Identity and Access Management (IAM) for the Internet of Things (IoT) and Blockchain. Our KeyScaler™ platform provides trust for IoT devices and the IoT ecosyste
IBM Guardium Key Lifecycle Manager centralizes, simplifies and automates the encryption key management process to help minimize risk and reduce operational costs of encryption key management. It offer
The protection you need when you need it, with Data Protection on Demand. Thales’ Data Protection on Demand empowers organizations with a high level of security, efficiency, and flexibility, all wi
Ubiq enables enterprises to encrypt, tokenize, and mask sensitive data at the individual record and file level and integrates with Identity Providers (Okta, Entra ID) to ensure only authorized users w
iSecurity Field Encryption protects sensitive data using strong encryption, integrated key management and auditing. Encryption is vital for protecting confidential information and expediting complianc
Privileged credentials are some of the highest-value targets for cybercriminals. Keeper Secrets Manager is a fully managed cloud-based, zero-knowledge platform for securing infrastructure secrets s
ManageEngine Key Manager Plus is a web-based key management solution that helps you consolidate, control, manage, monitor, and audit the entire life cycle of SSH (Secure Shell) keys and SSL (Secure So
Ensure company and customer data is secure across your hybrid cloud. Protect your data at rest with hardware and software-based AES-256 bit encryption solutions. Maintain data encryption in transit fo
Alibaba Cloud Key Management Service (KMS) is a secure and easy-to-use service to create, control, and manage encryption keys used to secure your data
EncryptRIGHT simplifies application-level data protection, delivering robust encryption, tokenization, dynamic data masking, and key management functionality, along with role-based data access control
Enables competitively-sensitive parties to exchange information directly, and in a fundamentally new way.
nShield hardware security modules (HSMs) provide a hardened, tamper-resistant environment for secure cryptographic processing, key generation and protection, encryption and more.
KAPALYA empowers organizations and their employees to securely store sensitive files at-rest and in-transit across multiple platforms through a user-friendly desktop and mobile application. This ubiqu
Entrust nShield as a Service is a subscription-based solution for generating, accessing, and protecting cryptographic key material, separately from sensitive data, using dedicated FIPS 140-2 Level 3 c
EnvKey is a software that prevent insecure sharing and config sprawl. Works as an end-to-end encrypted configuration and secrets management.
Keyfactor Control enables IoT and embedded device manufacturers to seamlessly integrate, update, and manage the security of their products throughout their lifecycle. From device design and developmen
Lockr is the first hosted API & encryption key management for modern content management systems like Drupal and WordPress, providing an affordable and easy to deploy solution for all sites to prop
Quick, secure PCI compliance, and much more. As easy as an API. Tokenization, data governance and access control, customer key management, fully customizable data schemas, REST and SQL APIs. Runs in
CipherTrust Cloud Key Manager (CCKM) simplifies management of cloud-native, BYOK, and HYOK keys from a single unified management console. Increase efficiency and operational resilience, and securely s
Absio moves data security to the top of the stack with application-level data security solutions and consulting services
DigiCert Trust Lifecycle Manager is a converged public and private digital trust solution for CA-agnostic certificate management and PKI services. Trust Lifecycle Manager centralizes visibility and co
DuoKey is a Swiss-based company, headquartered in Prilly, which specialises in advanced encryption and key management solutions. The company offers a comprehensive suite of key management and encryp
Transparent Data Encryption for any application or database on the Windows Platform. Physical, Virtual or Cloud. SQL Server, MySQL, Web Servers, Legacy Applications. With Centralized Key Management. N
The Entrust Cryptographic Security Platform is an innovative solution that unifies cryptographic management by combining the rich capabilities used to operate public key infrastructure (PKI), certific
Entrust KeyControl redefines cryptographic key and secrets management by combining key lifecycle management and a decentralized vault-based architecture with a comprehensive central policy and complia
If your organization faces the operational risk of certificate-related outages, compliance gaps in PKI governance, or security vulnerabilities from unmanaged machine identities, Evertrust's CLM soluti
With Fortanix, organizations gain the freedom to accelerate their digital transformation, combine and analyze private data, and deliver secure applications that protect the privacy of the people they
HyTrust KeyControl simplifies the process of key management for applications that do not require sophisticated policy based key management – but still need to perform to scale to enterprise grade leve
IBM Guardium Data Encryption consists of an integrated suite of products built on a common infrastructure. These highly-scalable solutions provide encryption, tokenization, data masking and key manage
The Data Control Platform by IronCore Labs gives developers tools to control access to data with encryption to build minimal trust, zero-trust, and end-to-end encryption applications. Make the world
KeyNexus is a cloud-based encryption-key storage and provisioning service purpose-built for developers of cloud-based applications.
Complete vendor-independent key management solution.
Accelerate your speed of innovation while ensuring data privacy, security and compliance. As easy as an API. Fast to implement, endlessly customizable, and ready to help you solve the biggest data pri
A Key Part of Fortra (the new face of HelpSystems) Powertech is proud to be part of Fortra’s comprehensive cybersecurity portfolio. Fortra simplifies today’s complex cybersecurity landscape by bringin
Privakey Cloud uses the OpenID Connect framework and behaves much like a social login, making it easy to enable for websites, online services, and apps.
RevBits Privileged Access Management is a four-in-one solution that includes privileged account, password, key and certificate management, as well as extensive session logging that captures keystrokes
Randtronics DPM Key Manager provides centralized key lifecycle management for Randtronics and non Randtronics encryption products.
Sepior provides advanced cryptographic key management and protection software, libraries, SDKs and toolsets. Our customers are typically platform developers, service providers, product providers, or l
SSH Universal Key Manager grants, automates and enables single sign-on remote access to the digital core of every Fortune 500 company.
Protect your business Tanker helps companies deal with sensitive user data.
CipherTrust Manager from Thales is the key management solution, allowing businesses to manage encryption keys, define access control, and configure security policies from a single management console.
Unbound Key Control (UKC) is a unified key manager and virtual HSM which provides full key lifecycle management across on-premise data centers and multiple cloud environments. This pure-software solu
VAULTODY is a custody technology platform that provides a secure MPC wallet infrastructure for seamless and flexible crypto assets management. The platform combines industry-leading protection technol
PROTECT DATA STORED ON SERVERS AND BACKUP DRIVES WITH ZECURION STORAGE SECURITY
Encryption key management software assists companies with protecting and managing their cryptographic keys used for encrypting data on devices and in applications. Encryption key management software manages encryption keys throughout a key pair’s lifecycle, which includes key generation, exchange, use, integrity, availability, storage, backup or archive, revocation, and deregistration or destruction. On the backend, these tools manage encryption key generation, distribution, and replacement, while on the client side, the tools inject encryption keys and store and manage them on devices. These software solutions protect the keys by ensuring that only authenticated and authorized users can access them, preventing them from being disclosed, lost, misused, or intercepted by unauthorized parties.
What Do KMS and HSM Stand For?
KMS stands for key management systems. Key management systems are centralized hubs that manage the key lifecycle, including generation, certification, storage, usage, expiration, revocation, and retirement. Centralized key management systems work in conjunction with hardware security modules (HSMs). KMS may also be known by the following acronyms: CKMS, which is cryptographic key management system, or EKMS, which stands for enterprise key management system.
HSM stands for hardware security modules. Hardware security modules are servers built to be tamper-resistant or tamper-proof. HSMs generate, retrieve, share, and protect keys. These are considered the most secure key storage as these are physically built to prevent tampering by using special tamper-resistant screws and sealants.
On-premises encryption key management
Some companies opt to store their key manager on-premises using a hardware security module (HSM), which is a server built to be tamper-resistant or tamper-proof.
Cloud-based encryption key management
Some companies have complex key management needs and need a solution that scales to meet the volume and complexity of their encryption key transaction needs. Centralized cloud-based encryption key management can assist with symmetric and asymmetric key management and work with various databases, applications, and standards. Bring your own encryption (BYOE) or bring your own key (BYOK) is akin to the bring your own device (BYOD) security models—companies bring their own encryption key management software to deploy on public cloud infrastructure. However, this security model has trade-offs as this may entail giving cloud providers access to keys, which may not meet a company’s security policies.
Key management as a service
Some cloud providers offer their own key management as a service solution in their cloud environments.
The following are some core features within encryption key management software:
Interoperability: For companies that use multiple types of cryptographic keys and multiple software applications, interoperability is important. Many encryption key management solutions are based on standard protocols, including Key Management Interoperability Protocol (KMIP) standard or Public Key Crypto Standard (PKCS 11). Other solutions will rely on closed-source key management.
Policy management: Companies may have specific policies for their encryption keys, including when to expire or revoke them or methods to prevent sharing the keys. Encryption key management software will enforce these policies.
Access management: In addition to creating and managing the keys themselves, it is important to manage who has access permissions to those keys. Many companies employ a least-privilege policy where users and systems have the least access needed to achieve their role function. Encryption key management solutions can enforce those policies, ensuring that only authorized and authenticated users or systems have access to the keys can prevent misuse. These tools will also provide access and audit logs.
Backup: If the keys are lost, access to the encrypted data will be unrecoverable without backup. Many encryption key management solutions offer backup features.
If not properly managed, encryption keys can fall into the wrong hands and be used to decrypt sensitive data. This can risk sensitive encrypted data or disrupt critical business information access. Managing encryption keys manually can be challenging to meet today’s business needs as the scale and complexity of applications used and the encryption and keys needed to secure those have grown, which is why many companies have opted for automated management solutions. If data encryption key management is managed manually, this time-consuming task may come at the expense of speed, availability, interoperability, accuracy, and integrity.
Security: The main purpose of encryption and, therefore, encryption key management is security. Encryption key management software assists in managing encryption keys at scale in a secure manner and remains available to meet business needs.
Meeting regulatory compliance: Some highly regulated industries are bound by various data protection regulations for storing and managing encryption keys. Using encryption key management software, companies can meet requirements of regulations such as PCI DSS 3.2.1, NIST 800-53, and NIST 800-57.
Scalability: Today’s businesses rely on multiple devices and applications needing encryption, meaning they need an encryption key management solution that scales at speed to generate, distribute, and manage the keys. This can mean the ability to generate hundreds of keys per minute. Many businesses require low latency and high availability for their keys.
Information security professionals: Information security professionals use encryption key management solutions which may include on-premises solutions like HSMs, centralized cloud-based solutions, or cloud-infrastructure-specific software-as-a-service solutions.
IT professionals: If a company does not have a dedicated information security (infosec) team, the responsibility for managing encryption keys falls on information technology (IT) teams.
Related solutions that can be used together with or as an alternative encryption key management software include:
Encryption software: Companies use encryption software to protect the confidentiality and integrity of their data. Encryption software will turn plaintext into cipher text using encryption. Keys to unencrypt the data will be stored using encryption key management solutions.
Email encryption software: To protect the confidentiality of data in transit, companies use email encryption software. Companies can use encryption key management solutions to protect the encryption keys.
Certificate lifecycle management (CLM) software: Public key infrastructure (PKI) is an asymmetric encryption key management system that utilizes digital certificates such as SSL or TLS certificates and public keys to secure assets like website traffic.
Secrets management tools: Developer and DevOps teams, in particular, may utilize secrets management tools to store sensitive digital assets, such as encryption keys.
BYOE or BYOK: Companies must carefully understand who has access to their encryption keys. When utilizing a BYOE or BYOK security model, it is important to know who has access to the keys, including providers.
Scalability and availability: It is important to ensure that generating, managing, utilizing, and retiring encryption keys meets your company’s scale and availability requirements.
Backup: If encryption keys are lost, companies must have a backup plan. Ensure the software solution you are evaluating meets your specific backup needs.
Regionality: Some geographic areas have data sovereignty and data residency requirements, so encryption keys may be managed differently based on the regional requirements.
Governance: Some data may be governed by data protection regulations, and a company’s encryption and encryption key management policies may need to meet specific regulatory compliance needs.
Gather your company’s specific encryption key management requirements, including if you need to manage your encryption keys on-premises, with a centralized cloud key management offering, or using an infrastructure-specific encryption key management service. It is important to determine what kind of interoperability you require. Also, consider the scale at which you need keys deployed and managed and the availability you seek. Discuss your backup needs. Authentication and access control functionality is also important. And determine which geographic areas your business needs are, and be sure to speak with vendors about these requirements.
Create a long list
The long list should include a list of providers that meet your basic interoperability, hosting, scale, regionality, and functionality requirements. Companies can identify products by using software review sites like G2.com to review what users of those solutions like and dislike, along with rankings on six satisfaction metrics.
Create a short list
Shorten your long list by identifying must-have functionality. Factors to consider at this stage include integrations, price, and whether the solution meets your regulatory requirements.
Conduct demos
When conducting demos of each potential solution, it is important to ask questions about the user interface, the ease of use, and the skills required to operate the encryption key management solution. The company’s staff should be able to learn the functionality of the tool quickly to receive the fastest return on investment.
Choose a selection team
The selection team should include employees using the encryption key management tool in their daily duties and understand the use case. These would typically be colleagues from information security (Infosec) and information technology (IT) teams. Other parties from leadership and finance should also be included.
Negotiation
Security products such as encryption key management tools help companies manage risk. Knowing the cost of a breach or exposed keys to an organization can help your company understand the value these tools bring to your company. Understand what your budget is with this in mind.
Final decision
Colleagues who work on defining and managing the company’s data security policies and programs are in the best position to decide which software solution fits the organization’s needs. These professionals will have the most experience with cryptography tools and can best evaluate the products.