Skip to content
Futurex Tops ABI Competitive Report as #1 Innovator!
Get the report
  • There are no suggestions because the search field is empty.
Futurex Tops ABI Competitive Report as #1 Innovator!
Get the report

VirtuCrypt Cloud HSM

Run payment or general-purpose HSM workloads on FIPS 140-3 Level 3 validated hardware without owning, racking, patching, or maintaining the physical appliance.

Cloud HSM

At a Glance

VirtuCrypt provides hosted access to the full CryptoHub ecosystem, including key management, tokenization, PKI, certificate authority services, data protection, and remote key loading. Every cloud instance is backed by FIPS 140-3 Level 3 validated Excrypt HSM hardware, while automated provisioning and clustering enable organizations to scale cryptographic processing capacity without managing physical infrastructure.

99.999% production SLA available across a globally distributed data center footprint

99.999% production SLA available across a globally distributed data center footprint

Strong integration with application workloads running in all major public cloud providers

Strong integration with application workloads running in all major public cloud providers

BYOK support with customer-controlled Major Keys

BYOK support with customer-controlled Major Keys

Native support for Post-Quantum Cryptography (PQC)

Support for Post-Quantum Cryptography (PQC) algorithms, including ML-KEM and ML-DSA

Hardware-backed assurance through a hosted operating model

A cloud HSM provides hardware-backed cryptographic processing through a hosted service model. Keys are generated, stored, and used inside FIPS-validated hardware, while the provider operates the infrastructure, facilities, patching, maintenance, and physical security.

VirtuCrypt is Futurex's cloud-hosted deployment model for Excrypt HSM and CryptoHub services. It provides hosted access to the same cryptographic solution suite that powers Futurex on-premises deployments, including encryption, key management, tokenization, PKI and certificate authority services, data protection, and remote key loading.

Cloud HSM describes the deployment model. Payment HSM and General Purpose HSM describe workload configurations. VirtuCrypt can host both, allowing payment and enterprise applications to use the service model that fits their infrastructure and regional requirements.

Clarify ownership without giving up control of keys 

Futurex operates Customers control or select
HSM infrastructure, facilities, physical security, patching, and maintenance Control of keys, including Major Keys, through BYOK
Availability design, automated device backup, off-site disaster recovery, and service operations The payment or general-purpose workload configuration required by each application
Compliance and audit support for the hosted environment Regional deployment based on latency, data residency, resilience, and strategic requirements
Provisioning and clustering of hosted HSM capacity Application integration across on-premises, hybrid, and public cloud environments
Managed Key Services when a managed path is selected Whether to use BYOK or Managed Key Services for key loading and transport

 

BYOK allows customers to retain control over keys, including Major Keys, over mutually authenticated TLS. Teams that prefer a managed path can use Managed Key Services delivered under dual control by Futurex Solutions Architects.

Design for availability, recovery, and regional requirements

VirtuCrypt operates across a globally distributed data center footprint with 16+ sites worldwide and a production SLA of up to 99.999%. Off-site disaster recovery and automated device backup are built into the service model. Additional SLA options are available.

Organizations can provision capacity across regions to address latency, data residency, resilience, and expansion requirements. Teams running Excrypt HSMs on-premises can also use VirtuCrypt for HSM backup and off-site disaster recovery without building and operating a second physical site.

Hardware-backed assurance through a hosted operating model

Use one hosted model across hybrid and multi-cloud architectures

VirtuCrypt supports cloud, hybrid, and multi-cloud cryptographic architectures. Teams can keep policy, key management, and HSM workflows consistent as applications run across on-premises infrastructure, Futurex-hosted environments, and public cloud services.

The service integrates with application workloads running in AWS, Google Cloud, and Microsoft Azure. Security teams can use VirtuCrypt as a hardware-backed root of trust for BYOK, HYOK, EKM, and CSE models across those environments.

Use one hosted model across hybrid and multi-cloud architectures-1

Choose the workload configuration the application requires

Payment HSM workloads

Payment HSM workloads

Run EMV, PIN, P2PE, card issuance, mobile payments, tokenization, and other payment cryptography workflows through the hosted platform.

General-purpose HSM workloads

General-purpose HSM workloads

Protect PKI, code signing, encryption, enterprise key management, and other general-purpose cryptographic workloads through the same hosted operating model.

Hosted CryptoHub services

Hosted CryptoHub services

Access HSM-backed key management, tokenization, PKI, certificate authority services, data protection, reporting, discovery, and remote key loading without operating the hardware. HubIQ reporting can provide visibility across cloud-hosted HSM, key management, PKI, and data protection workloads.

Support advanced algorithms without managing the refresh cycle

Because VirtuCrypt runs on the Excrypt HSM platform, cloud-hosted deployments can support advanced algorithm requirements, including ML-KEM and ML-DSA, without requiring customers to manage hardware refreshes.

Reference architecture

  • Cloud-hosted Excrypt HSM instances in one or more VirtuCrypt data centers
  • Clustered instances across regions for availability and disaster recovery
  • Integration points into AWS, Google Cloud, and Microsoft Azure application workloads
  • API and interface support for customer applications
  • HubIQ reporting across cloud-hosted HSM, key management, PKI, and data protection workloads
  • CryptoHub ecosystem services for key management, tokenization, PKI, CA, data protection, discovery, reporting, and remote key loading
Cloud HSM reference architecture for Futurex HSMs

Compliance support across hardware, facilities, and service operations

HSM hardware

Every cloud instance runs on FIPS 140-3 Level 3 validated Excrypt HSM hardware. Payment HSM configurations also run on PCI PTS HSM v4 certified hardware.

Data center

VirtuCrypt data centers maintain PCI PIN, PCI P2PE, and PCI DSS compliance, SOC 2 Type II attestation, and align with a wide range of industry controls for regulatory compliance and security best practices.

Payment service

VirtuCrypt payment services support PCI DSS, PCI PIN, and PCI P2PE controls relevant to payment data handling, PIN processing, and point-to-point encryption.

Frequently Asked Questions

Are VirtuCrypt cloud HSMs the same hardware used in Futurex on-premises HSMs?

Yes. VirtuCrypt cloud HSM instances run on Excrypt HSM hardware and command sets used in Futurex on-premises payment HSM and general-purpose HSM deployments.

How quickly can a new cloud HSM instance be provisioned?

Provisioning and clustering are automated, so new capacity can be added online quickly without hardware procurement or physical installation.

Do customers lose control of their keys in a hosted model?

No. BYOK allows customers to retain control over keys, including Major Keys. Managed Key Services are available for teams that prefer Futurex to handle the operational complexities of key management.

What SLA does the VirtuCrypt cloud HSM platform operate under?

VirtuCrypt Cloud HSM services run at up to a 99.999% production SLA across a globally distributed data center footprint. Additional SLA options are available.

Do cloud HSMs support advanced algorithms such as PQC?

 Yes. VirtuCrypt runs on the Excrypt HSM platform, which supports advanced algorithms including ML-KEM (FIPS 203) and ML-DSA (FIPS 204).

How are cloud HSMs different from payment HSMs and general-purpose HSMs?

Cloud HSMs describe the hosted deployment model. Payment HSM and general-purpose HSM describe workload configurations. VirtuCrypt hosts both.

How does VirtuCrypt relate to the CryptoHub ecosystem?

VirtuCrypt provides hosted access to HSM-backed CryptoHub services in a hosted model, including key management, tokenization, PKI, certificate authority services, data protection, reporting, discovery, and remote key loading.

Featured Resources

“Not only did Futurex allow us to move completely to the cloud, but the solution also increased our resilience and transaction response velocity.”

 

- Thiago Lopes, Information Security Manager

Pismo

Move HSM operations to a hosted model

Talk to Futurex about regional capacity, customer-controlled keys, disaster recovery, hybrid architecture, payment workloads, and enterprise cryptography through VirtuCrypt.