KeyRack

KeyRack is a self-hosted coordination layer for organizations that need to control encryption keys inside their own infrastructure. It is a strong fit for regulated teams, multi-cloud platforms, HYOK-based SaaS providers, and OpenStack operators with existing identity and policy services. Choose it for architectural control and backend flexibility; look elsewhere if you want a managed KMS or turnkey encrypted endpoints.

Overview

KeyRack organizes key use without replacing the systems that hold keys. It supports customer-managed keys and sends cryptographic work to PKCS#11 devices, HashiCorp Vault Transit, KMIP-compatible services, or an in-process provider intended for development and testing. Non-exportable keys remain in an HSM or Vault backend, while authorized export operations can expose exportable material.

You deploy and operate the software yourself rather than subscribing to a hosted cloud service. Identity is not included, so deployments must connect an OIDC provider such as Keycloak, Auth0, Okta, Azure AD, or Google Identity Platform. Authorization is likewise external, with policy decisions from systems such as Cedar or OPA checked for every operation.

Key features

Hierarchies, rotation, and policy

KEK-wrapping hierarchies, namespace-scoped rules, and cascade operations provide a structured way to apply key changes across related namespaces. That is useful when a platform must rotate or govern many dependent keys consistently, but it also means your policy service becomes a critical part of the operating model.

Backend choice and custody

PKCS#11, Vault Transit, and KMIP support let teams keep cryptographic custody in infrastructure they already manage. The in-process backend is practical for development and testing, not a substitute for protected production custody. Exportability remains a policy decision: non-exportable backend keys stay put, whereas approved exports can move raw material outside the backend.

Auditing and compatibility

Audit events can be sent to NATS, files, or standard output. BLAKE3 hash-chain linking helps reveal tampering in an event stream, and Ed25519 signing can be enabled when signed records are required. Commercial shims accept standard AWS SDK requests and the OpenStack Barbican REST API, helping existing clients connect without a wholesale interface change. GCP Cloud KMS and Azure Key Vault shims remain roadmap items, so those clouds do not receive equivalent support today.

Transport security

TLS is optional for gRPC, and the REST listener uses plain HTTP. HTTPS should therefore be terminated at a reverse proxy as part of deployment design; an unreviewed default configuration is not sufficient for exposed traffic.

Pricing

Open source core — free: The AGPL-3.0-or-later core is self-deployed and suits teams able to run the service and its surrounding identity, policy, and cryptographic infrastructure. Commercial extensions are separate.

Commercial licensing — custom pricing: Contact KeyRack for pricing and evaluation access. This tier adds HA clustering, key pooling, AWS KMS and Barbican shims, a management UI, vendor HSM adapters, and a KMIP server. It is the relevant route for organizations that need those integrations or operational features rather than assembling them around the free core.

Platforms

KeyRack is delivered as an API for self-hosted deployment. It is not a hosted web KMS, and operation, reverse-proxy configuration, identity integration, policy integration, and backend connectivity remain your responsibility.

Who it's for

Regulated industries can use the self-deployed model and HSM-backed custody to keep control within their environment. Multi-cloud platforms and SaaS providers using HYOK benefit from a common coordination layer across backends. OpenStack operators gain a Barbican-compatible path through the commercial shim. Smaller teams seeking a managed service, bundled identity, or encrypted listeners by default should consider a different category of product.

Pros and cons

• Pros: Free open-source core; supports HSM, Vault Transit, KMIP, and development backends; namespace-aware hierarchies and cascade operations; per-operation external policy checks; hash-chained audit delivery; customer-managed, non-exportable key custody.
• Cons: Self-hosting transfers availability and security work to your team; identity and authorization require separate services; REST is plain HTTP and gRPC TLS is opt-in; AWS and Barbican shims require commercial licensing; GCP and Azure shims are not implemented.

Alternatives

Thales CipherTrust Data Security Platform is the better fit when you want a freemium platform with a free-forever Community Edition, free trial, and web or Linux options alongside self-hosting.

Kleopatra suits users who need a free, open-source certificate manager for Linux or Windows rather than a service coordinating HSM and cloud backends.

Oracle Cloud Infrastructure Secret Management is preferable for an OCI-native API and web service with stated tenancy and secret-version limits.

Entrust Certificate Manager is a paid, multi-platform managed option for teams prepared to request a quote.

Cryptsoft KMIP Server focuses on a C or Java KMIP server SDK licensed through Cryptsoft.

Eviden KMS is a paid self-hosted choice with per-CPU pricing and connectors included.

OpenStack Barbican is the simpler free, open-source option when an API-focused OpenStack key service is sufficient.

Fornetix Key Orchestration Platform is a paid alternative with a full-featured 30-day trial.

Verdict

KeyRack is recommended for infrastructure teams that need an open-source, self-deployed coordination layer spanning key hierarchies and specialized cryptographic backends. Its main advantage is control over custody, policy, and integration boundaries. Look elsewhere if you need a hosted KMS, built-in identity, or production-safe encrypted listeners without additional deployment work.