Fortanix Data Security Manager vs OpenKCM (Open Key Chain Manager)
Fortanix Data Security Manager
fortanix.com
OpenKCM (Open Key Chain Manager)
openkcm.ioSide by side
| Figure | Fortanix Data Security Manager | OpenKCM (Open Key Chain Manager) |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Key Management Software | 7.7 (#6) | 7.1 (#11) |
| Spec score · Encryption Key Management Software | 7.7 (#8) | 7.3 (#10) |
| Deployment | Secrets management works on-premises, natively in the cloud, and across hybrid and multicloud environments. | The documentation describes deploying the Gateway near applications in a Kubernetes cluster or cloud VPC, and says the same Gateway software can run across AWS, Azure, and on-premise environments. |
| Integrations | The product provides REST APIs and supports open standards including OAuth, OpenID (SAML), LDAP, JWT, and PKI, as well as Kubernetes and Docker. | The trust model names AWS, Azure, and GCP external KMS services and on-premise Thales or Entrust HSMs as locations for customer root keys. |
Plans
Fortanix Data Security Manager
- Data Security Manager 30-days Free TrialFree
In their own words
Fortanix Data Security Manager
Fortanix Data Security Manager (DSM) gives DevOps and security teams a way to manage secrets, credentials, certificates, API keys and tokens outside source code. Secrets management can run on-premises, in the cloud, or across hybrid and multicloud environments. DSM provides REST APIs and supports standards and technologies including OAuth, OpenID (SAML), LDAP, JWT, PKI, Kubernetes and Docker.
Documented CI/CD integrations include HashiCorp Vault, Kubernetes Secret Store CSI Driver, Ansible, Jenkins, GitHub, GitLab, CyberArk, Delinea and Azure DevOps. Fortanix says the service stores secrets in a FIPS 140-2 Level 3 certified HSM and uses Intel SGX and Runtime Encryption technology. Role-based access controls, safeguards against unauthorized password changes, simultaneous-login alerts and audit logs support access oversight. Listed certifications include FIPS 140-2 Level 3, PCI-DSS, ISO 27001, CIS and SOC 2 Type 2. The DSM SaaS trial includes the full feature set for 30 days at free, with no credit card required to start. No numeric Enterprise price is listed.
OpenKCM (Open Key Chain Manager)
OpenKCM (Open Key Chain Manager) is a free, open-source key management service for governing encryption keys and protecting data at rest. It supports BYOK key import and HYOK, which keeps master keys in a customer’s infrastructure. Its recursive L1–L4 hierarchy makes data keys dependent on higher-level keys. Governance and policy control are handled by CMK, while Krypton performs cryptographic execution; applications request key operations through the KMIP API.
The Gateway is designed to run near applications, such as in Kubernetes or a cloud VPC, and the same software can operate across AWS, Azure and on-premise environments. Customer root keys can remain in AWS, Azure or GCP key services, or on-premise HSMs, while OpenKCM holds a reference to the L1 key. A kill switch can halt downstream key use by removing that reference or revoking the root key. CMK connects to a corporate identity provider and sends audit logs to SIEM systems. The project’s CMK and Krypton components are actively being developed; encryption and decryption operations are in progress, while audit export, high availability and disaster recovery are planned for 2027.