Why KeyRack
KeyRack is an open-source key management service (KMS) that runs in your infrastructure, on your terms.
The problem with cloud KMS
Section titled “The problem with cloud KMS”Every major cloud provider ships a KMS. They work well — until they don’t.
Vendor lock-in
Section titled “Vendor lock-in”Cloud KMS ties encryption keys to the provider’s platform. Migrating means re-encrypting every piece of data with new keys — often the single biggest blocker to cloud migration.
No real key custody
Section titled “No real key custody”Cloud providers manage the HSMs. “Customer-managed keys” still mean the provider’s HSM, firmware, and physical security.
No instant revocation
Section titled “No instant revocation”When a tenant needs to cut off platform access, there is no guaranteed mechanism for immediate key revocation. The gap between “revoke” and “actually unusable” is provider-controlled.
API fragmentation
Section titled “API fragmentation”Each cloud KMS has its own API. Multi-cloud architectures end up with per-provider encryption code, key management, and audit trails.
KeyRack’s answer
Section titled “KeyRack’s answer”Data-plane KMS you deploy yourself
Section titled “Data-plane KMS you deploy yourself”KeyRack handles key lifecycle management and cryptographic operations without giving a third party access to your keys. It is software you operate — the security boundary is yours to define.
Pluggable crypto providers
Section titled “Pluggable crypto providers”KeyRack separates key management logic from cryptographic operations. Supported backends today:
- PKCS#11 — FIPS 140-3 certified HSMs (Thales Luna, Entrust nShield, YubiHSM, AWS CloudHSM, SoftHSM for development)
- KMIP client — remote key servers and HSMs speaking the OASIS standard
- Vault Transit — HashiCorp Vault-backed operations
- Software — in-process RustCrypto for development and testing
Switch providers without changing application code. Your key hierarchy, policies, and audit trail remain intact.
Hold Your Own Key (HYOK)
Section titled “Hold Your Own Key (HYOK)”Tenants provision their own HSM or KMIP-compatible crypto backend. KeyRack manages the key hierarchy on top. In custody/managed mode (e.g. MongoDB KMIP default), key material never leaves the tenant’s HSM; in sovereign/keystore mode (e.g. MySQL, Percona), an exportable key is served and the value prop is governance, not “keys never leave.” Disconnect the HSM and crypto operations fail immediately; cross-node staleness in the commercial HA tier is bounded by a configurable TTL.
Cryptographic audit trail
Section titled “Cryptographic audit trail”Every operation emits an audit event with BLAKE3 hash-chain linking and full operation metadata. The chain is maintained unconditionally — it does not depend on signing being enabled — so keyrack audit verify detects modified, deleted, and reordered events with no key at all.
Two bounds on that, stated plainly. Keyless verification catches edits made in place; defeating it means recomputing every link from the edit point forward, which an attacker with write access to the whole log can do. And tail-truncation — dropping the newest N events — breaks nothing internal to the log, so detecting it needs an external anchor such as a signed checkpoint or independent witness.
Ed25519 signing is opt-in, requires a persistent signing key, and is what closes the first bound: it establishes who wrote the log, which a chain alone cannot. See the security model for the full statement. Events are delivered via NATS for real-time consumption.
API compatibility (commercial)
Section titled “API compatibility (commercial)”Existing AWS SDK or OpenStack clients can talk to KeyRack unchanged via the commercial AWS KMS and Barbican shims — see Commercial extensions. For a FOSS-first step that keeps crypto on AWS, the keyrack-aws-proxy adds visibility with zero code changes (Brownfield migration).
Who should use KeyRack
Section titled “Who should use KeyRack”- Regulated industries — DORA, NIS2, HIPAA, PCI-DSS, or national data sovereignty requirements
- Multi-cloud platforms — single KMS interface across AWS, Azure, GCP, or private cloud
- SaaS providers — HYOK model for enterprise customers who hold their own keys
- OpenStack operators — real tenant key isolation with cascade-disable and PDP authorization
Comparison
Section titled “Comparison”| Feature | Cloud KMS | KeyRack |
|---|---|---|
| Key sovereignty | Provider-controlled HSM | Customer-controlled (PKCS#11/KMIP) |
| Instant revocation | Provider-dependent | HSM disconnect is immediate; cross-node staleness bounded by configurable TTL (commercial HA) |
| Multi-cloud portable | No | Yes (single KMS) |
| HYOK | Limited | Full: tenant-managed HSM |
| Authorization | IAM (provider-specific) | Cedar policy-as-code |
| Open source | No | Core is AGPL-3.0-or-later |
Getting started
Section titled “Getting started”- Repository: github.com/KeyRack-io/keyrack
- Quickstart: Operator guide or run a demo
- Commercial extensions: Commercial licensing