Security & key custody

How Ekam protects the key that signs your agents' identities · operated by Krutrim SI Designs Private Limited (a Krutrim group company)

Ekam issues the identity tokens your agents authenticate with. The key that signs those tokens is the single most sensitive secret we hold — so we treat it accordingly.

Hardware-rooted key custody

Hardware root of trust. The signing key is protected by a Thales HSM-sealed vault. Trust flows from certified hardware, not from a config file.
No plaintext key at rest. The key is stored only as ciphertext, wrapped by a key-encryption key that never leaves the HSM-sealed vault. Our database, backups and disk images contain nothing usable.
In-memory only. At startup a workload decrypts the key into memory for the lifetime of the process. It is never written back to disk in the clear.
No static secrets. Workloads authenticate to the vault with short-lived, cluster-issued identity — not a long-lived token that can leak and be replayed.
Fail-closed. If the vault is unreachable, Ekam refuses to start rather than fall back to a weaker key. There is no silent degradation and no backup plaintext copy to fall back to.
Verifiable trust, offline. Every token is ES256-signed; relying parties verify signatures offline against our public JWKS — no callback to Ekam on the hot path.

What this means for you. Compromising our datastore yields no usable signing key; there is no static credential to steal; and you can independently verify both the custody posture and every token we issue.

Verify it yourself

Live attestation. GET /healthz reports keySource: "vault" — the running system confirms its key was unwrapped from the HSM-sealed vault, not loaded from a static secret.
Offline signature check. Fetch /.well-known/jwks.json and verify any token we issue against it, with no call back to us.
Guided validation. On request we'll walk your security team through a live demonstration — including that the service fails closed when vault access is removed, proving there is no hidden plaintext key.

Compliance posture

This design keeps Ekam outside the PCI-DSS audit boundary while inheriting HSM-rooted trust, mirroring the pattern used by our IAM and SSH key-management services. Personal data is stored and processed on Krutrim Cloud, in India, with cross-region disaster recovery (see DPDP and Privacy).

Scope, stated plainly. Signing is performed in application memory, not inside the HSM. Full "the key never touches a host under any circumstance" assurance is covered by third-party audit on our roadmap — we don't claim it here.

Security questions or a vendor assessment? Contact security@olakrutrim.com.