Service Specifications

The payShield Cloud HSM service has the following specifications:

Security Certifications

The data centers used to host the HSMs are PCI DSS certified. Also, the HSMs are PCI HSM v3 and FIPS certified, and the service data centers are compliant with PCI PIN Security audit requirements.

Thales Responsibility

Thales controls the following aspects of the service:

1. Allocation of HSMs to eligible customers of the service.
2. Managing the physical HSM infrastructure (including installation of HSMs in data centers, and basic network configuration including cabling/connections to switches and routers).
3. Obtaining ongoing FIPS, PCI HSM, and other regional certifications for the HSMs offered as a part of a subscription package.
4. Enhancing the cryptographic functionality offered by the HSMs in line with payment market application and security requirements.
5. Providing 24x7 support to service users for matters relating to HSM functionality or operation.
6. Performing periodic diagnostic checks.
7. Replacing any faulty HSMs ensuring minimum possible downtime.

Your Responsibility

You (as the service user) are responsible for all the areas of management and operation of the HSMs under your subscription agreements namely:

1. HSM security configuration and master key management (LMK, ZMK, KEK, etc.)
2. Remote HSM management via payShield Manager
3. Loading of base/custom software and associated licenses
4. Audit trail management
5. Ensure sufficient subscriptions to meet backup, load balancing, disaster recovery, and redundancy needs
6. HSM monitoring
7. Overall payment system audit compliance for your payment applications

Message Protection Mechanism

payShield HSM supports both TLS and Non-TLS host connections. It is highly recommended to use TLS for communication between the payment application and the payShield Cloud HSM.

HSM Options

The service currently supports the standard payShield 10K HSM that is identical to the on-prem device.

Customization Options

The software customization service fulfilled by the Thales Professional Services team is available for use with any HSM used in a payShield Cloud subscription.