Fortanix Data Security Manager vs KeyRack
Fortanix Data Security Manager
fortanix.com
KeyRack
keyrack.ioSide by side
| Figure | Fortanix Data Security Manager | KeyRack |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Key Management Software | 7.7 (#6) | 7.5 (#8) |
| Audit | Comprehensive audit logs provide insight into how secrets are used. | Audit events can be delivered through NATS, files, or stdout and include BLAKE3 hash-chain linking; Ed25519 signing is opt-in. |
| Deployment | Secrets management works on-premises, natively in the cloud, and across hybrid and multicloud environments. | KeyRack is software you deploy in your own infrastructure, rather than a hosted cloud KMS. |
| Integrations | The product provides REST APIs and supports open standards including OAuth, OpenID (SAML), LDAP, JWT, and PKI, as well as Kubernetes and Docker. | The commercial AWS KMS shim accepts standard AWS SDK requests, while the commercial Barbican shim exposes the OpenStack Barbican REST API. |
| Support | Fortanix provides customer support, documentation, downloads, REST API documentation, FAQs, a technical support program, and professional services links. | The maker directs users to GitHub issues for project issues and to a responsible disclosure process for security vulnerabilities. |
Plans
Fortanix Data Security Manager
- Data Security Manager 30-days Free TrialFree
In their own words
Fortanix Data Security Manager
Fortanix Data Security Manager (DSM) gives DevOps and security teams a way to manage secrets, credentials, certificates, API keys and tokens outside source code. Secrets management can run on-premises, in the cloud, or across hybrid and multicloud environments. DSM provides REST APIs and supports standards and technologies including OAuth, OpenID (SAML), LDAP, JWT, PKI, Kubernetes and Docker.
Documented CI/CD integrations include HashiCorp Vault, Kubernetes Secret Store CSI Driver, Ansible, Jenkins, GitHub, GitLab, CyberArk, Delinea and Azure DevOps. Fortanix says the service stores secrets in a FIPS 140-2 Level 3 certified HSM and uses Intel SGX and Runtime Encryption technology. Role-based access controls, safeguards against unauthorized password changes, simultaneous-login alerts and audit logs support access oversight. Listed certifications include FIPS 140-2 Level 3, PCI-DSS, ISO 27001, CIS and SOC 2 Type 2. The DSM SaaS trial includes the full feature set for 30 days at free, with no credit card required to start. No numeric Enterprise price is listed.
KeyRack
KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.