# Hanzo HSM — Hanzo AI

> Hardware Security Module (HSM) and KMS integration: unified cryptographic key management across AWS KMS, Google Cloud KMS, and Azure Key Vault.

# Hanzo HSM

One interface to the key hardware you already trust — AWS KMS, Azure Key Vault, Google Cloud KMS, or a Zymbit module over PKCS#11. Generate keys, sign with them, and unwrap with them, without the private material ever reaching your process.

[View on GitHub](https://github.com/hanzoai)

What it is

- Keys never leave the hardware01
- You send a message, you get a signature02
- The key that opens the database03
- Post-quantum, and honest about where it runs04
- Threshold signing, where the hardware can do it05
- Bring the module you already have06

Signing and unwrapping happen inside AWS KMS, Azure Key Vault, or a Zymbit secure module. Hanzo holds a handle, never the key.

The private key is made inside the module and stays there. Your code passes a key id and some bytes and receives a signature back, so there is no moment at which the key exists in your process to be leaked, logged, or written to a core dump.

The password that decrypts an encrypted store is itself stored encrypted, and the module decrypts it at boot. Nothing on the disk, in the environment or in a manifest is enough on its own to read the data.

ML-DSA-65 is available as a signing algorithm today. On a module with post-quantum firmware it runs inside the boundary like any other key; without one it runs in the process, which is the right answer for a service that has to be quantum-ready before the hardware is, and the wrong one to describe as hardware-backed.

Some modules can run key generation and signing rounds internally, so no share is ever assembled anywhere. Shares are attested and encrypted at rest, and a share that arrives unattested is refused. Cloud key services cannot do this, and the interface says so rather than pretending.

AWS KMS, Google Cloud KMS, Azure Key Vault, a Zymbit secure compute module over local PKCS#11, or an in-memory signer for development. One Go interface behind all of them, so which module you use is a line of configuration rather than a rewrite.

Paste and ship

Paste this into any agent. It reads the skill manifest and calls HSM from there.

Agent promptCopy

```
Read https://hanzo.ai/skill.md and use Hanzo HSM in my project.
```

## Get started with HSM

[View on GitHub](https://github.com/hanzoai)

## Get HSM

Hardware security module

License: Apache-2.0[hanzoai](https://github.com/hanzoai)

[Deploy to Cloud](https://platform.hanzo.ai/deploy)