Securosys Brings External Key Management to Azure Customers Through Azure Key Vault Managed HSM

Securosys EKM Proxy bridges Azure Key Vault Managed HSM and Securosys Primus HSM or CloudHSM, giving regulated industries cryptographic control that never leaves their environment.

Zurich, 8 July 2026 - Securosys SA, a Swiss leader in cybersecurity, cloud security, encryption technology, and digital identity protection, today announced the launch of its External Key Manager (EKM) Proxy for Microsoft Azure, enabling organizations in regulated industries to meet data sovereignty and compliance requirements by ensuring encryption keys remain entirely under the customer's control. Securosys now supports Azure Key Vault Managed HSM's external key management feature, empowering European and regulated organizations with greater control over their data and encryption.

Encryption in the Cloud - But Who Holds the Keys?
For organizations in financial services, healthcare, and the public sector, moving sensitive workloads to the cloud has never simply been a technical decision. Compliance and audit requirements in these industries demand demonstrable proof that key material remains under the customer's governance, independent of the cloud provider. Data sovereignty - the principle that organizations retain full control over their data and the keys that protect it - has become a defining requirement for cloud adoption in regulated sectors.

Azure's existing Bring Your Own Key (BYOK) capability allows organizations to generate keys outside Azure before importing them into Azure Key Vault. Securosys already fully supports Azure BYOK, however, the recent external key management integration goes a step further: keys are never imported into Azure at all. Cryptographic operations are executed within the customer's own HSM environment, which is the level of separation that the strictest regulatory frameworks require.

Cloud Services, Without Surrendering Key Control
The Securosys EKM Proxy connects Azure Key Vault Managed HSM directly to a Securosys Primus HSM, whether deployed on-premises or via Securosys CloudHSM, so that cryptographic operations are executed inside the customer's own certified hardware. Only the results of those operations are returned to Azure. The keys themselves never move.

This allows organizations to run Azure workloads while at all times maintaining independent, auditable control over their key material. The Securosys Primus HSM is compliant with FIPS 140-3 Level 3 and Common Criteria standards, the certifications regulators and auditors look for.

"For years, our customers in banking, healthcare, and government have faced an impossible choice: the agility of the cloud, or the compliance certainty of keeping keys in-house," says Robert Rogenmoser, CEO of Securosys. "With this integration, that trade-off no longer exists. Encryption keys remain in the customer's HSM, under their governance, always, while their teams get every benefit of Azure. That's a genuinely new position for regulated enterprises to be in."

Cloud Agility Without Compliance Compromise
The integration also gives organizations an operational advantage: because keys are never imported into Azure, customers retain the ability to maintain, manage, and govern their key material independently of the cloud platform at all times. The Proxy API is intentionally limited to cryptographic operations, meaning key lifecycle management remains entirely within the Securosys HSM environment. The ability to revoke keys at any time, rendering the associated data unreadable, gives customers the assurance that they remain in control under any circumstance.

Deployment is designed to be straightforward: the EKM Proxy is delivered as a Docker container, configurable via a YAML file, and can be stood up in a customer-controlled environment, whether on-premises or in their own cloud infrastructure. A single proxy instance supports multiple Azure Managed HSM pools, enabling operational segregation between Azure workloads and teams while maintaining a centralized connection to the customer's Primus HSM or CloudHSM environment.

The Securosys EKM Proxy for Azure is available now. Getting started requires an Azure account with Azure Key Vault Managed HSM configured for external key management, a Securosys Primus HSM or CloudHSM partition, and a host environment for the proxy container. Full documentation, including prerequisites, configuration guides, and installation instructions, is available through the Securosys documentation at https://docs.securosys.com/azure-ekm/overview.

Securosys SA
Max-Högger-Strasse 2
8048 Zürich
Switzerland

Presscontact:
Martina Alig / Securosys SA
Max-Högger-Strasse 2
8048 Zürich
Switzerland

martina.alig@securosys.com
0041445523100

Securosys SA, headquartered in Zurich, Switzerland, is a renowned industry leader specializing in cybersecurity, encryption, and digital identity protection. The company was founded in 2014, and its hardware security modules (HSMs) secure transactions of over 100 billion euros every day on the Swiss banking center SIC (under the supervision of the Swiss National Bank) as well as the Swiss stock exchanges SIX and SDX. Over half of the world's Tier 1 banks and many other technology companies trust the HSMs developed and produced by Securosys in Switzerland.

Securosys' comprehensive HSM solutions, available both on-premises and in the cloud as SaaS, are certified to the highest security standards, including FIPS and Common Criteria. Securosys HSMs are customized for various industries such as finance, healthcare, government, and more. They offer unrivalled features such as independent, cryptographically secure partitions, patented, policy-based, individual key protection and cloud readiness. The devices support hybrid signatures, ensuring a seamless transition from classical to post-quantum cryptographic (PQC) algorithms. These innovations make Securosys' HSMs a trusted choice for secure key generation, management, encryption, and digital signing for any application.

This release was published on openPR.