Move from your current HSM. Never expose a key.
Migration risk lives in the transfer. Roost makes the transfer key itself, so plaintext never exists outside an HSM.
The plan
Four steps, no plaintext.
01
InventoryList every key, its use and whether it can be exported.
02
Exportable keysRoost generates a one-time wrapping key and shares only its public half. Your current HSM wraps the key with it.
03
Non-exportable keysNew keys are generated inside Roost and certificates are reissued on a schedule.
SIGNED
Run side by sideBoth systems run until the last key has moved.
Safeguards
Every move is on record.
- Imported keys are permanently marked as imported, separate from keys born inside Roost
- Each import requires a passkey approval and is recorded
- A reissue plan for keys that cannot leave your current HSM
See Roost refuse an unapproved signature.
A 30-minute live demo with our engineers.