Securosys adds Azure key control for regulated customers

Securosys launched an External Key Manager Proxy for Microsoft Azure on July 8, 2026, giving regulated organizations a way to keep encryption keys under customer control while using Azure Key Vault Managed HSM. The integration is aimed at sectors like banking, healthcare and government that need stronger data sovereignty and compliance controls.

Why it matters: - Regulated organizations can use Azure workloads without importing encryption keys into Microsoft Azure. - The setup is designed to help customers meet data sovereignty, compliance and audit requirements. - Securosys positions the integration as a way to remove the trade-off between cloud agility and key control.

What happened: - Securosys SA launched its External Key Manager (EKM) Proxy for Microsoft Azure on July 8, 2026. - The proxy supports Azure Key Vault Managed HSM’s external key management feature. - The product connects Azure Key Vault Managed HSM to Securosys Primus HSM or Securosys CloudHSM. - The launch targets organizations in regulated industries, including financial services, healthcare and the public sector.

The details: - The EKM Proxy keeps encryption keys entirely under the customer’s control. - Cryptographic operations run inside the customer’s own certified HSM environment. - Only the results of those operations are returned to Azure. - The keys themselves never move into Azure. - Securosys says the approach goes beyond Azure Bring Your Own Key, where keys are generated outside Azure and imported into Azure Key Vault. - The Securosys Primus HSM is compliant with FIPS 140-3 Level 3 and Common Criteria standards. - The proxy is delivered as a Docker container and can be configured through a YAML file. - A single proxy instance can support multiple Azure Managed HSM pools. - Deployment can run in a customer-controlled environment on-premises or in the customer’s own cloud infrastructure. - Getting started requires an Azure account with Azure Key Vault Managed HSM configured for external key management, a Securosys Primus HSM or CloudHSM partition, and a host environment for the proxy container. - Full documentation is available through Securosys documentation.

Between the lines: - The move reflects growing pressure on cloud users to prove that key material stays under independent governance. - Securosys is betting that regulated enterprises want cloud access without giving up operational control of keys. - The proxy’s limited API suggests Securosys wants key lifecycle management to stay outside the cloud provider’s reach. - The revocation capability gives customers a direct way to make associated data unreadable if needed.

What's next: - Securosys says the EKM Proxy for Azure is available now. - Customers interested in the integration will need the required Azure, HSM and container-hosting setup before deployment. - Organizations adopting the tool can use Azure while keeping key governance inside Securosys-managed HSM infrastructure.

The bottom line: - Securosys is giving regulated Azure customers a new way to keep encryption keys outside the cloud while still using Microsoft’s managed HSM services.