Security and Compliance
KMS uses third-party certified Hardware Security Modules (HSMs) to generate and protect keys. Security and quality controls are certified by multiple compliance programs. Operations such as creating and managing your master keys are performed within compliant HSM hardware.
High Availability
Ensuring the continuous availability of critical keys is the cornerstone of business continuity. Tencent Cloud KMS employs a three-tier architecture to achieve cross-AZ high availability at the key storage, cryptographic operation, and service access layers, thereby mitigating risks associated with single points of failure:
Cross-AZ redundancy for key data: Your keys and their critical information are automatically backed up in encrypted form to multiple AZs in different physical locations. Even if a single AZ fails, other backup points ensure that the keys remain securely available, without affecting business encryption and decryption operations.
Cross-AZ deployment of HSM clusters: The underlying hardware security modules (HSMs) that perform cryptographic operations are deployed in a distributed manner across multiple data centers. When a single AZ fails, the system can quickly switch cryptographic operation tasks to healthy HSMs in other AZs, maintaining stable encryption service operation.
High availability for service access points across AZs: The TencentCloud API access points and control nodes of KMS are also deployed across multiple AZs. If an AZ encounters an issue, client requests automatically switch to service nodes in other AZs, ensuring continuous access to the management page and API.
Centralized Key Management
You can access Tencent Cloud KMS service via APIs, SDKs, and integrated cloud products. Use KMS to centrally manage the key policies for your business applications, regardless of whether those applications are deployed within or outside Tencent Cloud.
Cost Controllability
No specialized hardware encryption devices need to be purchased. With one-click deployment and a pay-as-you-go model, Tencent Cloud provides all backend service maintenance.
Minimalist Encryption & Decryption Service
KMS Premium Edition uses envelope encryption. Complex key management is fully encapsulated by the Encryption SDK. You only need to call the encryption and decryption APIs and manage CMK permissions to encrypt and decrypt massive volumes of local data.