- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Luna HSM
A key in a physical box in your data centre — Luna HSM generates and stores keys inside tamper-resistant hardware, and key material never leaves in usable form. No cloud provider, no vendor and no administrator can extract it.
Data residency & processing — two different questions
Where data lives
Yours — deploy on-premises in India
CipherTrust Manager deploys as a virtual appliance or physical hardware in your own data centre, and Luna HSM is a box you own. Keys, ciphertext and policy stay on infrastructure you control — no residency answer for India is stronger, and the evidence takes the form of a serial number and access log, not a clause in a contract.
The constraint, stated plainly
No India SaaS region — and Noida is people, not data
CipherTrust as-a-Service runs in Europe and North America only. Thales has 2,200+ staff in India with Noida as its Cyber & Digital engineering centre, and that is a genuine commitment — but people in India and data in India are different facts. Answering a residency question with an engineering presence is the error that tends to show up at audit time.
For a residency-bound Indian buyer this pushes you to on-premises deployment, which is very likely what your regulator wanted anyway. Under the DPDP Act the sequence matters more than the product: find the personal data first, then protect it. For RBI-regulated entities the question behind the question is usually who can decrypt, and whether administrators can read production data — both answerable here with evidence rather than assurance. And note what does not exist, so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant. No vendor in this category has a Gartner Leader placement, and any implying one is misleading you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Thales platform family
This page covers Luna HSM — the hardware root of trust. The rest of the Thales data-security platform:
Quick facts
30-second orientation- Product
- Luna HSM — hardware key custody
- What it is
- A tamper-resistant physical appliance
- The guarantee
- Key material never leaves the device in usable form
- Also
- CipherTrust Manager can be rooted in it
- Vendor
- Thales — Chairman & CEO Patrice Caine
- The cyber arm
- Thales Cloud Protection & Licensing
- Analyst standing
- KuppingerCole Overall Leader 2025 — Data Security Platforms
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- India engineering
- 2,200+ staff; Noida is the Cyber & Digital centre
- Data residency
- Yours — deploy on-premises or virtual in India
- Data processing
- On your infrastructure; CipherTrust SaaS is EU/NA only
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, key-custody scoping
Understand hardware security modules before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
A tamper-resistant hardware security module: keys are created, held and used inside certified hardware, and callers only ever receive the result of an operation.
Software-held keys vs Luna HSM — the honest table
What moving keys into hardware actually changes, dimension by dimension.
| Dimension | Software-held keys | Luna HSM |
|---|---|---|
| Where keys live | In memory and files on a host | Inside tamper-resistant hardware |
| Host compromise | Can yield the key material | Yields API access while it lasts, not keys |
| Administration | One admin, full power | M-of-N quorum with PED keys (S-series) |
| Certification | Depends on the software stack | FIPS 140-3 Level 3 (Luna Network HSM 7) |
| Backup | Key files copied somewhere | Hardware to hardware, Luna Backup HSM |
| Audit evidence | Configuration screenshots | Serial number, partition and audit log |
| Cost profile | Licence only | Appliance, support, second site, operations |
| Best fit | General encryption hygiene | Keys that must never exist in software |
Luna HSM keeps keys inside certified, tamper-evident hardware that you own. The trade is operational: PED custody, firmware changes, backup and a second appliance. Thales publishes no list price; TechBag quotes in INR with GST.
The five pieces of Luna HSM
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the product line, demystified.
Network appliance
A 1U rack appliance that many applications share over the network. A-series models use password authentication; S-series use multi-factor PED keys for high-assurance roles.
Card and USB
A PCIe card when the HSM must live inside one server, and a USB HSM for offline roots — a root CA key that is powered on only for a signing ceremony.
Partitions
Each application or team gets its own partition and credentials — five on a 700 model, up to 100 on a 790 — so one appliance serves many owners without sharing keys.
Backup & HA
Keys back up hardware-to-hardware to a Luna Backup HSM, and HA groups load-balance across appliances. Lose the backup’s PED credentials and the backup cannot be recovered.
Luna 8
Launched on 4 August 2026 as a network appliance with ML-KEM and ML-DSA; FIPS 140-3 Level 3 and Common Criteria were still under assessment. PCIe, USB and cloud versions are planned.
The key is generated in the device, used in the device, and backed up only to another device.
Twelve capabilities. Custody, integration, operations.
What Luna HSM actually does — holds keys in certified hardware, serves them to applications through standard APIs, and gives you the partitions, HA and backup to run it.
Keys That Stay in Hardware
Keys are generated and used inside tamper-evident hardware; applications receive the result of an operation, never the key material itself.
FIPS 140-3 Level 3 Validation
Luna Network HSM 7 is validated to FIPS 140-2 and FIPS 140-3 Level 3, in both password and multi-factor (PED) modes, per Thales’s product brief.
Common Criteria and eIDAS
Common Criteria EAL4+ against EN 419 221-5, and a Qualified Signature or Seal Creation Device listing — relevant when you sign for EU counterparties.
M-of-N Multi-Person Control
PED keys with M-of-N quorum mean no single administrator can restore keys or change a sensitive policy alone.
PKCS#11, JCA, CNG and OpenSSL
Standard interfaces cover most certificate authorities, signing tools, databases and web servers without custom integration work.
Root for CipherTrust Manager
CipherTrust Manager can use a Luna HSM as its root of trust, so the master key protecting every other key never exists in software.
CA, Document and Code Signing
Holds certificate-authority, document-signing and code-signing keys — the workloads most likely to carry an explicit HSM requirement.
A Post-Quantum Path
Luna 7 offers PQC mechanisms through its PQC Functionality Module; Luna 8 adds native ML-KEM (FIPS 203), ML-DSA (FIPS 204) and LMS/HSS signatures.
Up to 100 Partitions
Separate partitions and credentials let one appliance serve several applications; the 790 models support up to 100 partitions.
REST API Administration
A REST API and remote management mean routine administration does not need someone standing in the data centre.
HA Groups and Load Balancing
HA groups spread load and fail over across appliances; two units in two sites is the minimum for a service that must survive a site loss.
Hardware-to-Hardware Backup
Back up partitions to a Luna Backup HSM on-premises or to the cloud; the backup is only as safe as the custody of the credentials that unlock it.
Watch Luna HSM in action
The overview, getting started, and the core workflows.
Introducing Thales Luna HSM 8 — Quantum-Safe
The appliance, presented by Thales.
What is a Hardware Security Module (HSM)?
The category, explained.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Software can be breached. Hardware keeps the key.
Here’s what genuinely sets Luna HSM apart (and where software key management is enough).
Keys that cannot be extracted, structurally
Software key management is often enough, but keys sit in host memory, where an attacker who controls the host can extract them. An HSM generates and uses keys inside tamper-resistant hardware, so a hijacked server can request operations while its foothold lasts but never gets the key. That is what regulators mean by hardware protection.
The strongest possible answer to an Indian residency question
Hardware key custody ends residency debates: the key sits in a physical box in your data centre in India, under your administrators, beyond the reach of a cloud provider or vendor. Auditors get access logs and a serial number, not a clause, which matters for IRDAI- and RBI-regulated entities and government buyers.
It is the root the rest of the platform stands on
Rooting CipherTrust Manager in a Luna HSM means the master keys protecting everything else are generated and held in hardware, never in software. A key hierarchy is only as strong as its root, and a master key in a VM’s memory is weaker than diagrams suggest; if you buy the platform, root it properly.
The honest cost: this is an appliance, not software
HSM budgets capture the appliance and miss the rest: support, firmware maintenance, security-domain backup that is unforgiving if neglected, new separation-of-duties roles, and at least a second unit elsewhere to survive a data-centre failure. None is exotic, and we would rather price it with you now than surprise you in month three.
The honest positioning
Buy an HSM only if keys truly must never exist in software, such as a regulator or payments/PKI mandate; otherwise virtual CipherTrust Manager costs far less. If procurement needs BIS, check the model: Thales lists BIS (IS 13252) for Luna Network HSM 7; Entrust announced it for nShield Connect XC in 2019.
The numbers behind the platform
What your Luna HSM journey looks like
Confirm the hardware mandate
Name the rule, scheme or risk finding that demands keys in hardware. If none does, CipherTrust Manager alone may be enough.
Pick model and authentication
A- or S-series, partition count and throughput. Choose PED multi-factor if a regulator or CA policy expects quorum control.
Initialise and run the ceremony
Initialise appliances, create partitions and cloning domains, and record the key ceremony with named witnesses.
Integrate, then pull the plug
Connect applications over PKCS#11, JCA or CNG, then take one unit out of the HA group and confirm service continues.
Patch firmware, rehearse restore
Treat firmware updates as change events, and restore from the Luna Backup HSM at least once a year to prove it works.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We moved the issuing CA keys onto S-series appliances with PED quorum. Ceremonies take longer now, which is rather the point.”
“Our e-sign platform already documented a Luna PKCS#11 integration, so go-live was about the key ceremony, not the code.”
“Budget two appliances from day one. We bought one, then spent a quarter justifying the second after our first DR test.”
“Partitions let three business units share one HA pair without sharing keys, which ended an argument that had run for a year.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the hardware security module market — tap any vendor to see why it sits where it does.
TechBag HSM Grid
Execution strength vs product vision among general-purpose HSM vendors.
Full range — appliance, card, USB, cloud — plus Luna 8.
Deployment Choice × Custody Assurance
How many ways you can deploy it vs how strong the key custody is.
Most form factors; strong custody controls.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Luna HSM vs the HSM field
Entrust nShield, Utimaco, AWS CloudHSM and Thales’s own Luna Cloud HSM — honest lanes. nShield is the closest like-for-like; CloudHSM rents custody inside one cloud; Luna Cloud HSM has no India region. We say so.
| Dimension | Luna HSM | Entrust nShield | Utimaco | AWS CloudHSM | Luna Cloud HSM |
|---|---|---|---|---|---|
| What it is | Network, PCIe and USB HSMs you own | Network and PCIe HSMs you own | German HSM specialist, general-purpose and payment | Single-tenant HSMs rented inside AWS | HSM partitions as a service from Thales DPoD |
| Where the key lives | Your data centre | Your data centre | Your data centre | An AWS region — Mumbai is available | DPoD in Europe or North America only |
| FIPS validation | 140-2 and 140-3 Level 3 (Luna 7) | Level 3 — check the specific model | Level 3 — check the specific model | hsm2m.medium: 140-3 Level 3 | Backed by FIPS 140-2 Level 3 HSMs |
| India BIS listing | IS 13252 listed for Network HSM 7 | Connect XC BIS-certified (2019) | Confirm with the vendor | Not applicable — rented | Not applicable — a service |
| Multi-person control | PED keys, M-of-N (S-series) | Smartcard quorum (Security World) | Smartcard-based quorum | Quorum authentication available | Service-managed; partition credentials yours |
| Pricing | Quote — hardware plus support | Quote | Quote | Published hourly rate per HSM | Subscription via the DPoD marketplace |
| The thing to plan around | PED custody, backup, a second site | Security World operations | Local support coverage in India | Custody tied to one cloud | No India region |
| Best fit | Keys that must stay in your building | Estates already on Security World | Buyers who also need payment HSMs | Workloads that live entirely in AWS | Non-India workloads wanting no hardware |
Which way of holding keys in hardware fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Luna HSM if…
- ✓A regulator, scheme or CA policy requires keys in certified hardware
- ✓The key must physically sit in your own Indian data centre
- ✓You want CipherTrust Manager rooted in hardware
- ✓You can staff PED custody, backup and a second site
Entrust nShield if…
- ✓You already run Security World, or your CA software is certified on nShield
AWS CloudHSM if…
- ✓The applications using the keys run entirely in AWS, and a Mumbai region is acceptable custody
Luna Cloud HSM if…
- ✓The workload is not India-bound and you want HSM custody without owning hardware
Software key management if…
- ✓No rule demands hardware — CipherTrust Manager alone meets the need at lower cost
Luna HSM is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (applications whose keys move into the HSM; loaded engineer-hour cost). The estimate contrasts hand-managed software keys — key files on hosts, manual rotation, audit evidence gathered by hand — with keys held in Luna and used through standard APIs. Illustrative only: the case for an HSM is usually a mandate, not a saving.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Luna HSM is quote-priced: a hardware purchase plus annual support, with the model (A- or S-series; 700, 750 or 790) setting the price. Thales publishes no list price. Budget a second appliance, a Luna Backup HSM and PED keys too. TechBag quotes in INR with GST.
Luna Network HSM 7
Best for shared, networked key custody
- A-series (password) or S-series (PED multi-factor)
- 700, 750 or 790 models — 5 to 100 partitions
- Hardware purchase plus annual support, quote-only
Luna PCIe or USB HSM
Best for one server or an offline root
- PCIe card inside a single host
- USB HSM for offline CA roots and ceremonies
- Pair with a Luna Backup HSM for recovery
+ TechBag scoping
Best value with TechBag
- Model and partition sizing against your throughput
- Second site, backup and PED custody costed up front
- INR invoicing with GST, local support
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which regulation, scheme or internal finding requires keys in hardware — and does it name a FIPS level?
Which Luna model gives the partitions and RSA/ECC throughput we need, with headroom?
Do we need S-series PED quorum, or is A-series password authentication acceptable?
Who holds each PED key, where are they stored, and who are the deputies?
Is a second appliance in a second site budgeted, and how will the HA group be set up?
Where will the Luna Backup HSM live, and when will we first test a restore?
Does our process require BIS or another certification for a specific model?
Luna 7 now, or Luna 8 once its FIPS and Common Criteria assessments complete?
Questions buyers ask
Ready to put your keys in hardware?
Scope Luna HSM with a TechBag advisor — the model and partition count, A- or S-series authentication, the second appliance and backup HSM, PED custody and the key ceremony — compared honestly against Entrust nShield and cloud HSMs, and quoted in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.