Details that matter

Own the keys, not the HSM

What is nShield as a Service?

nSaaS is a subscription-based, post-quantum ready solution for generating, accessing, and protecting cryptographic key material—separately from sensitive data—using FIPS‑certified nShield HSMs delivered as a cloud service.

Ready for migration or a mixed approach

Because nShield as a Service benefits from the same unique Security World architecture as on-prem nShield deployments, you can easily migrate your cryptographic operations from on-prem to the cloud, or use a hybrid approach, mixing both cloud-based and on-prem nShield HSMs for increased redundancy and reliability.

Simplifying Your Cloud Migration

Today's enterprises seek the flexibility of cloud deployments. However, when the HSMs acting as your trust anchors reside in your datacenter, access from your cloud applications becomes complex and expensive. With nSaaS your applications can access your HSMs from anywhere—your datacenter, your cloud deployments, or both—while benefiting from:

Predictable Budgeting - Convert CapEx to OpEx with monthly performance-based pricing
Comprehensive Protection - Extend cryptography and key management across multiple clouds
Optimized Resources - Decrease time spent on maintenance and monitoring tasks

Geo-fencing

Regional data centers facilitate geo-fencing to meet cloud data security and data sovereignty mandates.

Crypto Security + Cloud Strategy

Advance your cloud-centric strategies with FIPS 140-2 Level 3 protection for your business-critical apps and data.

Maintain Full Control of Your Keys

Supports multi-cloud/hybrid deployments with the same consistent toolset. Flexibility to migrate workloads on premises or to another Cloud Service Provider.

Secure Code Execution

The CodeSafe secure execution capability provides on-demand access to your organization's secure, sensitive code protected inside the HSM.

Technical Specifications

Full specifications for nShield as a Service

Specification	Details
Connectivity	IPsec tunnel w/pre-shared keys Between customer Cloud IP space(s) and dedicated, managed nShield HSM environment Transparent to client hosts Takes entire path out of control scope
Security Compliance:	FIPS 140-3 (legacy support for FIPS 140-2) PCI-DSS (US Datacenters only)
Safety and Environmental Standards Compliance:	UL, CE, FCC, RCM
Canada ICES	RoHS2, WEEE, Data Center Certifications
Supported APIs	PKCS#11, OpenSSL, Java (JCE), Microsoft CAPI/CNG
Supported Cryptographic Algorithms	Asymmetric public key algorithms: RSA, Diffie-Hellman, ECMQV, DSA, KCDSA, ECDSA, ECDH, Edwards (X25519, Ed25519ph)
Secp256k1,	NIST standardized post‑quantum algorithms: ML‑DSA(44, 65, 87), ML‑KEM(512, 768, 1024)
Specifications	Symmetric algorithms: AES, AES-GCM, ARIA, Camellia, CAST, RIPEMD160 HMAC, SEED
Triple DES	Hash/message digest: SHA-1, SHA-2 (224, 256, 384, 512 bit)
HAS-160	Full Suite B implementation with fully licensed ECC including Brainpool and custom curves, nShield HSMs offers support for the majority of these cryptographic algorithms as part of the standard feature set. For organizations wishing to use ECC or South Korean algorithms, optional activation licenses are needed., Supported Platforms

Documentation

Download product documentation and resources

Entrust Security Certification

nShield as a Service

Reference Document

nShield as a Service Data Sheet

Easy, efficient access to high-assurance cryptography as a service

Data Sheet

nShield as a Service Cloud Disaster Recovery

Off-site failover as a service to increase redundancy and resiliency for on-premises hardware security module (HSM) estates

Solution Brief

Entrust nShield® 5s HSMs

High-Performance, PQ-Secure, Next-Generation, Crypto-Agile PCIe Hardware Security Modules

Solution Brief

Discover More

Similar Products

Explore other configurations and models that might suit your needs.

nShield as a Service (nSaaS)

Details that matter

What is nShield as a Service?

Ready for migration or a mixed approach