KMS External Key Store (XKS) is now in private preview
November 3, 2026
NewSecurityKMSEncryption
Exoscale Key Management Service (KMS) now supports External Key Store (XKS) in private preview. XKS connects Exoscale KMS to a key manager or Hardware Security Module (HSM) that you operate through an XKS proxy that you host. Your external key material remains under your control and is never stored or seen by Exoscale.
Key benefits
- Keep control of your root of trust. Hold key material in infrastructure you operate to meet demanding security, sovereignty and regulatory requirements.
- Protect data with two encryption layers. Exoscale KMS and your external key manager encrypt data independently, so neither party can decrypt it alone.
- Reuse compatible infrastructure. Exoscale implements version 1 of the AWS KMS External Key Store Proxy API, allowing compatible proxies to connect without modification.
- Add your own authorization and audit layer. Every request to your proxy carries metadata, including the operation and a request ID, so you can enforce your own policies and keep an independent record of each use of your key, on top of the controls Exoscale KMS already provides.
Because the external key stays under your control, so do its availability and durability: cryptographic operations require your proxy and external key manager to be reachable, and data cannot be recovered if the external key is permanently lost.
XKS is currently in private preview. Its API operations are marked [BETA] and may change.
