- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Luna HSM
A key in a physical box in your data centre — Luna HSM generates and stores keys inside tamper-resistant hardware, and key material never leaves in usable form. No cloud provider, no vendor and no administrator can extract it.
Data residency & processing — two different questions
Where data lives
Yours — deploy on-premises in India
CipherTrust Manager deploys as a virtual appliance or physical hardware in your own data centre, and Luna HSM is a box you own. Keys, ciphertext and policy stay on infrastructure you control — no residency answer for India is stronger, and the evidence takes the form of a serial number and access log, not a clause in a contract.
The constraint, stated plainly
No India SaaS region — and Noida is people, not data
CipherTrust as-a-Service runs in Europe and North America only. Thales has 2,200+ staff in India with Noida as its Cyber & Digital engineering centre, and that is a genuine commitment — but people in India and data in India are different facts. Answering a residency question with an engineering presence is the error that tends to show up at audit time.
For a residency-bound Indian buyer this pushes you to on-premises deployment, which is very likely what your regulator wanted anyway. Under the DPDP Act the sequence matters more than the product: find the personal data first, then protect it. For RBI-regulated entities the question behind the question is usually who can decrypt, and whether administrators can read production data — both answerable here with evidence rather than assurance. And note what does not exist, so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant. No vendor in this category has a Gartner Leader placement, and any implying one is misleading you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Thales platform family
This page covers Luna HSM — the hardware root of trust. The rest of the Thales data-security platform:
Quick facts
30-second orientation- Product
- Luna HSM — hardware key custody
- What it is
- A tamper-resistant physical appliance
- The guarantee
- Key material never leaves the device in usable form
- Also
- CipherTrust Manager can be rooted in it
- Vendor
- Thales — Chairman & CEO Patrice Caine
- The cyber arm
- Thales Cloud Protection & Licensing
- Analyst standing
- KuppingerCole Overall Leader 2025 — Data Security Platforms
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- India engineering
- 2,200+ staff; Noida is the Cyber & Digital centre
- Data residency
- Yours — deploy on-premises or virtual in India
- Data processing
- On your infrastructure; CipherTrust SaaS is EU/NA only
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, key-custody scoping
Understand hardware security modules before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
A tamper-resistant hardware security module: keys are created, held and used inside certified hardware, and callers only ever receive the result of an operation.
Software-held keys vs Luna HSM — the honest table
What moving keys into hardware actually changes, dimension by dimension.
| Dimension | Software-held keys | Luna HSM |
|---|---|---|
| Where keys live | In memory and files on a host | Inside tamper-resistant hardware |
| Host compromise | Can yield the key material | Yields API access while it lasts, not keys |
| Administration | One admin, full power | M-of-N quorum with PED keys (S-series) |
| Certification | Depends on the software stack | FIPS 140-3 Level 3 (Luna Network HSM 7) |
| Backup | Key files copied somewhere | Hardware to hardware, Luna Backup HSM |
| Audit evidence | Configuration screenshots | Serial number, partition and audit log |
| Cost profile | Licence only | Appliance, support, second site, operations |
| Best fit | General encryption hygiene | Keys that must never exist in software |
Luna HSM keeps keys inside certified, tamper-evident hardware that you own. The trade is operational: PED custody, firmware changes, backup and a second appliance. Thales publishes no list price; TechBag quotes in INR with GST.
The five pieces of Luna HSM
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the product line, demystified.
Network appliance
A 1U rack appliance that many applications share over the network. A-series models use password authentication; S-series use multi-factor PED keys for high-assurance roles.
Card and USB
A PCIe card when the HSM must live inside one server, and a USB HSM for offline roots — a root CA key that is powered on only for a signing ceremony.
Partitions
Each application or team gets its own partition and credentials — five on a 700 model, up to 100 on a 790 — so one appliance serves many owners without sharing keys.
Backup & HA
Keys back up hardware-to-hardware to a Luna Backup HSM, and HA groups load-balance across appliances. Lose the backup’s PED credentials and the backup cannot be recovered.
Luna 8
Launched on 4 August 2026 as a network appliance with ML-KEM and ML-DSA; FIPS 140-3 Level 3 and Common Criteria were still under assessment. PCIe, USB and cloud versions are planned.
The key is generated in the device, used in the device, and backed up only to another device.
Twelve capabilities. Custody, integration, operations.
What Luna HSM actually does — holds keys in certified hardware, serves them to applications through standard APIs, and gives you the partitions, HA and backup to run it.
Keys That Stay in Hardware
Keys are generated and used inside tamper-evident hardware; applications receive the result of an operation, never the key material itself.
FIPS 140-3 Level 3 Validation
Luna Network HSM 7 is validated to FIPS 140-2 and FIPS 140-3 Level 3, in both password and multi-factor (PED) modes, per Thales’s product brief.
Common Criteria and eIDAS
Common Criteria EAL4+ against EN 419 221-5, and a Qualified Signature or Seal Creation Device listing — relevant when you sign for EU counterparties.
M-of-N Multi-Person Control
PED keys with M-of-N quorum mean no single administrator can restore keys or change a sensitive policy alone.
PKCS#11, JCA, CNG and OpenSSL
Standard interfaces cover most certificate authorities, signing tools, databases and web servers without custom integration work.
Root for CipherTrust Manager
CipherTrust Manager can use a Luna HSM as its root of trust, so the master key protecting every other key never exists in software.
CA, Document and Code Signing
Holds certificate-authority, document-signing and code-signing keys — the workloads most likely to carry an explicit HSM requirement.
A Post-Quantum Path
Luna 7 offers PQC mechanisms through its PQC Functionality Module; Luna 8 adds native ML-KEM (FIPS 203), ML-DSA (FIPS 204) and LMS/HSS signatures.
Up to 100 Partitions
Separate partitions and credentials let one appliance serve several applications; the 790 models support up to 100 partitions.
REST API Administration
A REST API and remote management mean routine administration does not need someone standing in the data centre.
HA Groups and Load Balancing
HA groups spread load and fail over across appliances; two units in two sites is the minimum for a service that must survive a site loss.
Hardware-to-Hardware Backup
Back up partitions to a Luna Backup HSM on-premises or to the cloud; the backup is only as safe as the custody of the credentials that unlock it.
Watch Luna HSM in action
The overview, getting started, and the core workflows.
Introducing Thales Luna HSM 8 — Quantum-Safe
The appliance, presented by Thales.
What is a Hardware Security Module (HSM)?
The category, explained.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Software can be breached. Hardware keeps the key.
Here’s what genuinely sets Luna HSM apart (and where software key management is enough).
Keys that cannot be extracted, structurally
Software key management is genuinely good and often enough. What limits it is architecture, not a defect: the keys sit in host memory, and an attacker with enough control of that host can pull them out. An HSM removes that possibility by construction — the key is generated inside tamper-resistant hardware, used inside it, and never leaves in usable form. An attacker who takes over the application server calling the HSM can ask it to perform operations for as long as that foothold lasts; it does not get them the key. When a regulator asks a question specifically about hardware key protection, this distinction is what they mean.
The strongest possible answer to an Indian residency question
Data residency debates usually end in a discussion of vendor regions and contractual assurances. Hardware key custody ends them differently: the key is in a physical box, in your data centre, in India, under your administrators. It cannot be produced by a cloud provider or extracted by a vendor, and the evidence an auditor gets is the access log plus a serial number, not a clause. For IRDAI-regulated insurers, RBI-regulated entities and government buyers, that is a materially different conversation from any software answer.
It is the root the rest of the platform stands on
CipherTrust Manager can be rooted in a Luna HSM, which means the master keys protecting everything else are generated and held in hardware and never exist in software at all. That matters because a key hierarchy is only as strong as its root — protecting a thousand data keys with a master key sitting in a virtual machine's memory is a weaker arrangement than most architecture diagrams admit. If you are buying the platform and hardware custody is available, rooting it properly is the decision that makes the rest coherent.
The honest cost: this is an appliance, not software
Budgets for HSM projects go wrong in a predictable way — the appliance price is captured and everything around it is not. There is a support contract. There is firmware maintenance on a security-critical device. There is backup of the security domain, which is its own discipline and genuinely unforgiving if neglected. There is separation of duties: hardware key custody creates roles nobody previously had, and the person administering the device should not be the person approving key use. And if you want to survive a data-centre failure you need more than one unit, in more than one place. None of this is exotic. Every item is genuine, and we would prefer to price it alongside you today rather than let it surprise you in month three.
The honest positioning
Buy an HSM when the requirement is that keys must never exist in software, and be honest with yourself about whether that requirement is real. It usually arrives from a regulator asking specifically about hardware protection, from a payments or PKI use case with an explicit mandate, or from a risk assessment concluding a compromised host must not yield key material. If none of those applies, virtual CipherTrust Manager under your control satisfies the actual need at a fraction of the cost and operational burden, and we will tell you so. One procurement note worth raising early: if your process asks for BIS certification, check the exact model — Thales lists India BIS (IS 13252) for Luna Network HSM 7, and Entrust announced BIS certification for nShield Connect XC in 2019. We sell Entrust too.
The numbers behind the platform
What your Luna HSM journey looks like
Confirm the hardware mandate
Name the rule, scheme or risk finding that demands keys in hardware. If none does, CipherTrust Manager alone may be enough.
Pick model and authentication
A- or S-series, partition count and throughput. Choose PED multi-factor if a regulator or CA policy expects quorum control.
Initialise and run the ceremony
Initialise appliances, create partitions and cloning domains, and record the key ceremony with named witnesses.
Integrate, then pull the plug
Connect applications over PKCS#11, JCA or CNG, then take one unit out of the HA group and confirm service continues.
Patch firmware, rehearse restore
Treat firmware updates as change events, and restore from the Luna Backup HSM at least once a year to prove it works.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We moved the issuing CA keys onto S-series appliances with PED quorum. Ceremonies take longer now, which is rather the point.”
“Our e-sign platform already documented a Luna PKCS#11 integration, so go-live was about the key ceremony, not the code.”
“Budget two appliances from day one. We bought one, then spent a quarter justifying the second after our first DR test.”
“Partitions let three business units share one HA pair without sharing keys, which ended an argument that had run for a year.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the hardware security module market — tap any vendor to see why it sits where it does.
TechBag HSM Grid
Execution strength vs product vision among general-purpose HSM vendors.
Full range — appliance, card, USB, cloud — plus Luna 8.
Deployment Choice × Custody Assurance
How many ways you can deploy it vs how strong the key custody is.
Most form factors; strong custody controls.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Luna HSM vs the HSM field
Entrust nShield, Utimaco, AWS CloudHSM and Thales’s own Luna Cloud HSM — honest lanes. nShield is the closest like-for-like; CloudHSM rents custody inside one cloud; Luna Cloud HSM has no India region. We say so.
| Dimension | Luna HSM | Entrust nShield | Utimaco | AWS CloudHSM | Luna Cloud HSM |
|---|---|---|---|---|---|
| What it is | Network, PCIe and USB HSMs you own | Network and PCIe HSMs you own | German HSM specialist, general-purpose and payment | Single-tenant HSMs rented inside AWS | HSM partitions as a service from Thales DPoD |
| Where the key lives | Your data centre | Your data centre | Your data centre | An AWS region — Mumbai is available | DPoD in Europe or North America only |
| FIPS validation | 140-2 and 140-3 Level 3 (Luna 7) | Level 3 — check the specific model | Level 3 — check the specific model | hsm2m.medium: 140-3 Level 3 | Backed by FIPS 140-2 Level 3 HSMs |
| India BIS listing | IS 13252 listed for Network HSM 7 | Connect XC BIS-certified (2019) | Confirm with the vendor | Not applicable — rented | Not applicable — a service |
| Multi-person control | PED keys, M-of-N (S-series) | Smartcard quorum (Security World) | Smartcard-based quorum | Quorum authentication available | Service-managed; partition credentials yours |
| Pricing | Quote — hardware plus support | Quote | Quote | Published hourly rate per HSM | Subscription via the DPoD marketplace |
| The thing to plan around | PED custody, backup, a second site | Security World operations | Local support coverage in India | Custody tied to one cloud | No India region |
| Best fit | Keys that must stay in your building | Estates already on Security World | Buyers who also need payment HSMs | Workloads that live entirely in AWS | Non-India workloads wanting no hardware |
Which way of holding keys in hardware fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Luna HSM if…
- ✓A regulator, scheme or CA policy requires keys in certified hardware
- ✓The key must physically sit in your own Indian data centre
- ✓You want CipherTrust Manager rooted in hardware
- ✓You can staff PED custody, backup and a second site
Entrust nShield if…
- ✓You already run Security World, or your CA software is certified on nShield
AWS CloudHSM if…
- ✓The applications using the keys run entirely in AWS, and a Mumbai region is acceptable custody
Luna Cloud HSM if…
- ✓The workload is not India-bound and you want HSM custody without owning hardware
Software key management if…
- ✓No rule demands hardware — CipherTrust Manager alone meets the need at lower cost
Luna HSM is one of 21 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (applications whose keys move into the HSM; loaded engineer-hour cost). The estimate contrasts hand-managed software keys — key files on hosts, manual rotation, audit evidence gathered by hand — with keys held in Luna and used through standard APIs. Illustrative only: the case for an HSM is usually a mandate, not a saving.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Luna HSM is quote-priced: a hardware purchase plus annual support, with the model (A- or S-series; 700, 750 or 790) setting the price. Thales publishes no list price. Budget a second appliance, a Luna Backup HSM and PED keys too. TechBag quotes in INR with GST.
Luna Network HSM 7
Best for shared, networked key custody
- A-series (password) or S-series (PED multi-factor)
- 700, 750 or 790 models — 5 to 100 partitions
- Hardware purchase plus annual support, quote-only
Luna PCIe or USB HSM
Best for one server or an offline root
- PCIe card inside a single host
- USB HSM for offline CA roots and ceremonies
- Pair with a Luna Backup HSM for recovery
+ TechBag scoping
Best value with TechBag
- Model and partition sizing against your throughput
- Second site, backup and PED custody costed up front
- INR invoicing with GST, local support
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which regulation, scheme or internal finding requires keys in hardware — and does it name a FIPS level?
Which Luna model gives the partitions and RSA/ECC throughput we need, with headroom?
Do we need S-series PED quorum, or is A-series password authentication acceptable?
Who holds each PED key, where are they stored, and who are the deputies?
Is a second appliance in a second site budgeted, and how will the HA group be set up?
Where will the Luna Backup HSM live, and when will we first test a restore?
Does our process require BIS or another certification for a specific model?
Luna 7 now, or Luna 8 once its FIPS and Common Criteria assessments complete?
Questions buyers ask
Ready to put your keys in hardware?
Scope Luna HSM with a TechBag advisor — the model and partition count, A- or S-series authentication, the second appliance and backup HSM, PED custody and the key ceremony — compared honestly against Entrust nShield and cloud HSMs, and quoted in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.