Futurex CryptoHub vs KeyRack

Futurex CryptoHub is a unified encryption platform covering hardware security modules, enterprise key management, public key infrastructure, certificate authority, and data protection. It supports payment, general-purpose, and cloud HSM use cases, plus key lifecycle and payment key management, POS, ATM, and IoT key injection, application encryption, tokenization, and database TDE. Organizations can deploy an appliance, a virtual appliance on-premises or in the cloud, or a SaaS service in Futurex datacenters backed by Futurex HSMs. A wizard-driven dashboard creates virtual cryptographic modules on demand. One console handles control, monitoring, alerting, high availability, load balancing, orchestration, and automation. Interfaces include RESTful, Java, OpenSSL, PKCS #11, and MS CNG APIs and SDKs. Futurex lists integrations such as HashiCorp Vault, CyberArk Vault, Microsoft AD CS, Oracle Database TDE, and Microsoft SQL Server. CryptoHub supports multitenancy, audit logs, automatic key rotation, customer-managed keys, and HSM-backed keys. Pricing is on request; there is no free plan.

KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.