Can payments and PKI run on one device?

Yes, the Excrypt HSM Platform and CryptoHub carry both loads on one platform. The separation runs through up to 75 virtual HSMs and 250 partitions. In the Classic line the tasks stay apart, where Vectera Plus serves general applications and Excrypt SSP Enterprise v.2 serves payments.

How solid are the claims about FIPS and PCI?

Futurex names FIPS 140-3 Level 3 but publishes no certificate number, so we carry the claim as a vendor statement. The PCI claims also differ per page, and for CryptoHub one page names FIPS 140-2 Level 3 instead of 140-3. In tenders we state every claim with its source.

What happens to our devices of the Classic line?

Vectera Plus, Excrypt Plus and Excrypt SSP Enterprise v.2 are still sold. No announcement about an end of sale has reached us. The Excrypt HSM Platform is the successor, and the Excrypt Plus leads to the SSP Enterprise v.2.

Who operates the devices day to day?

You decide that: you run the devices yourself, hand operations to us or use VirtuCrypt. We work with operators of critical infrastructure and regulated industries and align roles, logs and emergency paths with that.

Futurex HSM: platforms, cloud and integration

Futurex at a glance

A hardware security module generates and stores cryptographic keys inside a certified device and never releases them in plaintext. Futurex brings two worlds together: payments with PINs and card keys and general applications such as PKI run on the same platform. One device carries up to 75 virtual HSMs and 250 partitions for applications.

Cryptography and hardware security modules are our core competence. We know the partitioning of the Excrypt platform, the command sets of the Classic line and the path into the VirtuCrypt cloud. We run your project from the selection through the integration into daily operations.

Lines: Excrypt HSM Platform, CryptoHub, Classic Enterprise, KMES
Highest validation: FIPS 140-3 Level 3 and PCI PTS HSM v4, vendor statement
Post-quantum algorithms: ML-KEM and ML-DSA, SLH-DSA announced
Operating forms: 1U appliance, PCIe card, VirtuCrypt cloud

The series in detail

Series 01

Excrypt HSM Platform

The Excrypt HSM Platform is the current hardware and replaces the Classic line, and Futurex publishes no individual model numbers for it. One device carries up to 75 virtual HSMs and 250 partitions for applications and delivers up to 40,000 RSA-2048 signatures per second. In June 2025 Futurex stated it was the only PCI HSM validated module with post-quantum algorithms, which is a vendor statement.

View device illustration

Models

Excrypt HSM Platform: Models
Excrypt HSM 1U appliance	Up to 100,000 payment operations per second
Excrypt HSM PCIe card	Installed in your own server
Excrypt HSM in VirtuCrypt	Cloud instance in the Futurex data center

Form factors: 1U appliance, PCIe card, Cloud instance
Operation: Your own data center, VirtuCrypt cloud

Certifications

FIPS 140-3 Level 3, vendor statement without a certificate number
PCI PTS HSM v4 per the listing page
PCI HSM validated per the product page

Features

Up to 75 virtual HSMs and 250 partitions per device
Up to 40,000 RSA-2048 signatures and 100,000 payment operations per second
ML-KEM and ML-DSA natively, SLH-DSA is announced
Random number generator on a quantum basis
Excrypt Universal Interface for the commands of older devices
PKCS#11, JCA and JCE, CNG, OpenSSL and REST

Vendor information

Series 02

CryptoHub

CryptoHub is a software defined platform that brings payment HSMs, general purpose HSMs, key management and certificate authorities onto one device. Several tenants work separately on it, and the appliance comes as a 2U device with up to 75 virtual HSMs. Next to it stand a virtual deployment, a deployment in a container and the CryptoHub Cloud operated by Futurex. The statements about the validation level differ: the appliance page names FIPS 140-3 Level 3, the cloud page names FIPS 140-2 Level 3 and PCI HSM.

Models

CryptoHub: Models
CryptoHub HSM	2U appliance with up to 75 virtual HSMs
CryptoHub virtual	Virtual appliance or container
CryptoHub Cloud	Operated by Futurex

Form factors: 2U appliance, Virtual appliance, Container, Cloud service
Operation: Your own data center, Virtualization, CryptoHub Cloud

Certifications

FIPS 140-3 Level 3 for the appliance, vendor statement
FIPS 140-2 Level 3 per the CryptoHub Cloud page
PCI HSM per the CryptoHub Cloud page

Features

Payment HSM and general purpose HSM in one platform
Key management across the whole life cycle, cloud keys included
Key injection for point of sale terminals, ATMs and IoT devices
Certificate authorities, tokenization and database encryption
Multitenancy, several areas on one device
The statements about the FIPS level differ per product page

Vendor information

Series 03

VirtuCrypt

VirtuCrypt is the cloud operated by Futurex and stood ready in 16 data centers in December 2025. The service comes in three tiers: Enterprise, Elements with billing per transaction and Plus as an extension of an installation in your own data center. For payments Futurex names PCI PTS HSM v4, plus FIPS 140-2 and 140-3 Level 3 as well as ML-KEM and ML-DSA.

Models

VirtuCrypt: Models
Enterprise	Tier for full operations in the Futurex cloud
Elements	Billing per transaction
Plus	Extension of an installation in your own data center

Form factors: Cloud service
Operation: Futurex cloud, Extension of your own data center, Marketplaces of AWS, Azure and Google Cloud

Certifications

FIPS 140-2 and FIPS 140-3 Level 3, vendor statement
PCI HSM
PCI PTS HSM v4 for payments

Features

16 data centers as of December 2025
ML-KEM and ML-DSA for post-quantum algorithms
Available through the marketplaces of AWS, Azure and Google Cloud
Bring your own keys through Excrypt Touch
Three tiers: Enterprise, Elements and Plus

Vendor information

Series 04

Vectera Plus

Vectera Plus is the general purpose HSM of the Classic Enterprise line, so of the prior generation, and it is still sold. The 1U device computes RSA up to 8192 bit and ECC. Virtual HSMs and partitions separate the applications, and custom code runs in the Secure Code Environment. It carries FIPS 140-2 Level 3 as well as the PCI PTS and PCI HSM validations. X9 TR-39 comes on top, and a cloud deployment runs in VirtuCrypt.

Models

Vectera Plus: Models
Vectera Plus	1U appliance for general applications
Vectera Plus in VirtuCrypt	Cloud deployment of the same series

Form factors: 1U appliance, Cloud instance
Operation: Your own data center, VirtuCrypt cloud

Certifications

FIPS 140-2 Level 3
PCI PTS and PCI HSM
X9 TR-39

Features

RSA up to 8192 bit and ECC
Virtual HSMs and partitions on one device
Secure Code Environment for custom code
REST, PKCS#11, JCE, CNG and OpenSSL interfaces
Cloud deployment through VirtuCrypt

Vendor information

Series 05

Excrypt SSP Enterprise v.2

The Excrypt SSP Enterprise v.2 is the payment HSM of the Classic Enterprise line. It stays backward compatible with the Excrypt SSP9000 and SSP9000 Enterprise. On throughput the sources name two values: the product page speaks of up to 50,000 transactions per second, the launch release of more than 20,000. Below it sits the Excrypt Plus with 5,000 transactions per second, 250 partitions and an upgrade path to the SSP Enterprise v.2.

Models

Excrypt SSP Enterprise v.2: Models
Excrypt SSP Enterprise v.2	Up to 50,000 transactions per second per the product page
Excrypt Plus	5,000 transactions per second and 250 partitions
Excrypt SSP9000 and SSP9000 Enterprise	Older devices that stay compatible

Form factors: 1U appliance
Operation: Your own data center

Certifications

FIPS 140-2 Level 3
PCI PTS HSM
PCI PTS HSM v3 for the Excrypt Plus
X9 TR-39

Features

Payment HSM of the Classic Enterprise line
The product page names up to 50,000 transactions per second, the launch release more than 20,000
Backward compatible with the Excrypt SSP9000 and SSP9000 Enterprise
Excrypt Plus with 5,000 transactions per second and 250 partitions
From the Excrypt Plus an upgrade path leads to the SSP Enterprise v.2

Vendor information

Series 06

KMES Series 3

The KMES Series 3 is a 2U key server with a built in HSM and manages certificates across their whole life cycle. It runs the offline root CA and the issuing CA, speaks KMIP and separates tenants. Keys it moves into public clouds as BYOK, EKM or CSE. A hybrid CA with post-quantum algorithms is announced, and operations run in your own data center or in VirtuCrypt. In addition there are devices for key injection, for the administration of fleets and for remote key loading.

Models

KMES Series 3: Models
KMES Series 3	2U server with a built in HSM
SKI Series 3	Key injection for 18 terminals at once
Guardian Series 3	Administration and audit of whole device fleets
Excrypt Touch	Tablet at FIPS 140-2 Level 3 for remote key loading

Form factors: 2U appliance, Cloud instance
Operation: Your own data center, VirtuCrypt cloud

Certifications

FIPS 140-2 Level 3 for the built in HSM
PCI PTS HSM
FIPS 140-2 Level 3 for the Excrypt Touch

Features

Offline root CA and issuing CA on one device
Manage certificates across the whole life cycle
BYOK, EKM and CSE for public clouds
KMIP for third party systems, separated tenants
A hybrid CA with post-quantum algorithms is announced

Vendor information

How you pick the right line

Four points decide the choice at Futurex: the kind of load, the generation of the devices, the required evidence and the operating model. We clear them in a workshop and record the result in a decision paper.

01

Kind of load

PINs and card keys require a payment HSM per PCI PTS. General applications such as PKI and code signing work with a general purpose HSM. The Excrypt HSM Platform and CryptoHub cover both on one device. The Classic line splits the tasks into Vectera Plus and Excrypt SSP Enterprise v.2.

02

Generation

The Excrypt HSM Platform is the current hardware and the successor of the Classic line, which Futurex still sells. Whoever runs Vectera Plus or Excrypt SSP Enterprise v.2 today plans the move along their own certificate lifetimes.

03

Evidence

Futurex names FIPS 140-3 Level 3 but publishes no certificate number for it, so we carry that as a vendor statement. On the PCI evidence the pages differ: the current platform is listed at v4, the Excrypt Plus at v3.

04

Operating model

You run the devices yourself, hand operations to us or use VirtuCrypt with 16 data centers. The service is also available through the marketplaces of the hyperscalers. For the transition the Plus tier connects your own data center with the cloud. The entire solution runs in German data centers.

Our work around Futurex

We do not only supply the device, we supply the work before and after it: selection, partitioning, connection of the applications, key ceremony and operations. We document the key ceremony so that auditors can follow it later. One team accompanies you from consulting to operations.

HSM consulting and integration
We cut virtual HSMs and partitions to size and connect PKCS#11, JCE and REST. The commands of the Classic line we translate through the Excrypt Universal Interface. We document the key ceremony in an audit proof form.
We cut virtual HSMs and partitions to size. We connect PKCS#11, JCE and REST. We keep translating the commands of the Classic line. The Excrypt Universal Interface serves that purpose. We document the key ceremony for auditors.
HSM & Key Management
PQC readiness
We record which keys and protocols rest on RSA and ECC today, because quantum computers threaten both algorithms. We then plan the path to ML-KEM and ML-DSA and state clearly that SLH-DSA is only announced so far.
We record your keys and protocols. We look for RSA and ECC in use. Quantum computers can break both algorithms. We then plan the path to ML-KEM and ML-DSA. We state clearly that SLH-DSA is only announced so far.
Post-Quantum Cryptography
Cloud
We connect your data center to VirtuCrypt or the CryptoHub Cloud. We set up the subscription through the marketplaces of the hyperscalers. Your own keys we bring in through Excrypt Touch.
We connect your data center to VirtuCrypt. The same holds for the CryptoHub Cloud. We set up the subscription through the marketplaces of the hyperscalers. We bring your own keys in through Excrypt Touch.
Cloud

Standards and evidence

These four rules decide the selection and the documentation in a Futurex project. We tell you which line carries each one today and which claim without a certificate number stays a vendor statement.

Requirement / Demands / OTOKO® delivers
Requirement	Demands	OTOKO® delivers
FIPS 140-3	Validated crypto modules with a defined physical protection level	Excrypt HSM Platform and CryptoHub at Level 3, without a published certificate number
PCI PTS HSM	Certified hardware for PINs and card keys	Excrypt HSM Platform and VirtuCrypt per v4, Excrypt Plus per v3
X9 TR-39	Review of key management in the card business	Vectera Plus and Excrypt SSP Enterprise v.2 support TR-39
KMIP	Vendor neutral key management	KMES Series 3 and CryptoHub speak KMIP for third party systems

Navigation

Futurex HSM: payments and PKI on one platform

Futurex at a glance

The series in detail

Excrypt HSM Platform

CryptoHub

VirtuCrypt

Vectera Plus

Excrypt SSP Enterprise v.2

KMES Series 3

How you pick the right line

Our work around Futurex

Standards and evidence

Frequently asked questions about Futurex

Related topics

You would like to learn more about

Futurex

Our clients

Our Partners