QxVault™
Secrets management vault with a built-in HSM.
Product Overview
Secrets. Simplified.
The QxVault™ is a fully integrated Secrets Management Vault with a built-in HSM for robust management of secrets, credentials, and API keys.
QxVault™ enables enterprises and governments to:
- Deploy with on-prem infrastructure or private cloud
- No HSM expertise required for deployment or operation
- Automatic HSM clustering and synchronization
- Built on the popular OpenBAO code base, compatible APIs and supports a broad ecosystem of integrations
- Based on Crypto4A QxHSM™ hardware and runs QxOS™
Reduced Cost
Transparent, simple, and predictable pricing with unlimited client licenses resulting in significant savings.
Reduced Complexity
Simplified deployment and management by integrating a FIPS 140-3 Level 3 HSM into the QxVault™ Blade Module.
Sovereignty
Centralized secrets management deployed in a customer environment or in a sovereign private cloud.
Future Proof Security
Support for both Classic and PQC backed secrets leveraging hardware based crypto-agility.
Product Features
QxVault™ highlights
- QASM™ - FIPS Certified Module built in
- Pending FIPS 140-3 level 3+ validation
- Multiple deployment options
- Built on OpenBao
- Broad ecosystem of compatible APIs
- Future-proof scalability and adaptability
Product Specifications
Clustering & Availability
- Automatic HSM & Vault clustering
- Disaster Recovery (DR) and fault-tolerance
- Business continuity of Operations (BCoOP)
Secrets Storage & Operation
API Support
Vault Lifecycle Management
Security Certifications
Host Interface
Onboard Compute/Single Board Computer (SBC)
Reliability
Physical Characteristics
Power
Safety & Environmental Compliance
Deployment options
Chassis Configurations
QxBMC-1 Desktop Chassis
- Single blade chassis
- Extended battery life: 5 years of additional unpowered standby
- Built in CLO
QxBMC-3
- 1RU 3 Blade Chassis
- Dual redundant, hot-swappable power supplies
- Built in CLO
QxBMC-12
- 4RU 12 Blade Chassis
- Integrated dual network 40G switch card with (4) 10G ports and SFP+ interface
- Dual redundant, hot-swappable power supplies
- Built in CLO
Use Cases
Where QxVault™ shines
Secure Secret Storage
Arbitrary key/value secrets can be stored in QxVault™. QxVault™ encrypts these secrets prior to writing them to persistent storage, so gaining access to the raw storage is not enough to access your secrets.
Dynamic Secrets
QxVault™ can generate secrets on-demand for some systems, such as Kubernetes or SQL databases. After creating these dynamic secrets, QxVault will also automatically revoke them after the lease is up.
Data Encryption
QxVault™ provides encryption as a service with centralized key management to simplify encrypting data in transit and stored across clouds and datacenters.
Identity based access
Organizations need a way to manage identity sprawl with the use of different clouds, services, and systems. QxVault™ solves this challenge by using a unified ACL system to broker access to systems and secrets and merges identities across providers.
Leasing and Renewal
All secrets in QxVault™ have a lease associated with them. At the end of the lease, QxVault™ will automatically revoke that secret. Clients are able to renew leases via built-in renew APIs.
Revocation
QxVault™ has built-in support for secret revocation. QxVault™ can revoke not only single secrets, but a tree of secrets, for example all secrets read by a specific user, or all secrets of a particular type.