What FIPS 140-2 Level 3 actually requires
The certification that regulated banks insist on, broken down.
Tamper-evident
Physical enclosure shows evidence of attempted entry; the module zeroizes all plaintext CSPs on detection.
Identity-based auth
Every operator authenticates per-session with split-knowledge quorum. No shared admin password.
Trusted path
Key material enters/exits only via cryptographically authenticated channels — never over unprotected interfaces.
EFP / EFT
Environmental failure protection and test — fault injection via voltage, temperature, or timing is defended and logged.
Certified modules we deploy
We deploy across multiple vendors for vendor-diversity; a single vendor CVE cannot compromise the validator set.
What lives in the HSM.
The HSM is the last line. Only keys that must never leak live there — everything else is wrapped and stored in KMS or MPC cohorts.
Operational controls.
HSM + MPC
The HSM holds one MPC share. This is strictly better than either alone.
HSM alone
Strong per-key security; single point of trust. Vendor compromise or insider access can be catastrophic.
MPC alone
No single party holds the key; depends on operational security of every share-holder's environment.
HSM + MPC (Lux default)
One share lives inside an HSM under quorum access, others across independent regions. Attacker needs HSM bypass and enough cohort shares.
Hardware-rooted from day one.
Deploy on our HSM fleet or bring your own module (HYOK).