Thalassa Cloud Launches Key Management Service in Early Access

Last year we shared that we were building KMS and Secrets Manager for Thalassa Cloud. Today we are happy to be opening our Key Management Service (KMS) in Early Access.

What is KMS, and why does it matter?

A Key Management Service (KMS) is where you create, store, and control the cryptographic keys used across your environment. Applications and platform services call the KMS API to encrypt data, verify signatures, or generate keyed hashes — instead of embedding key material in configuration files or managing crypto libraries per service.

That matters because encryption and signing touch almost everything: database fields, object storage, TLS certificates, API tokens, DNSSEC zone signing, and secrets at rest. Without a managed KMS, teams either wire up keys themselves — often via self-hosted OpenBao or HashiCorp Vault transit — or depend on a hyperscaler key service outside the platform they run workloads on. For organisations that chose Thalassa for European data sovereignty, neither option fits well.

Thalassa KMS keeps key operations local, API-driven, and governed by the same IAM and audit logging as the rest of the cloud platform. Other Thalassa services consume KMS rather than implementing their own cryptography. This also gives teams control, as those Keys can be managed through the KMS API; teams can rotate, revoke or (when enabled) export keys according to their own compliance and technical requirements.

Encryption, signing, and HMAC

Thalassa KMS exposes three cryptographic operations through the API. You choose the key type and algorithm at creation; the table below lists what is supported today.

Key lifecycle and control

Besides encryption and signing APIs, KMS includes controls for how keys are created, rotated, and retired. These lifecycle features are available from the console and API.

Early Access, GA later this year

KMS is available now in Early Access on Thalassa Cloud. We are actively gathering feedback from early adopters and plan to promote the service to general availability later in 2026.

During Early Access you get full API and console access to create and use keys. As with other Early Access services, we recommend validating against your workloads before relying on KMS for production-critical paths - and we welcome your feedback as we harden the service toward GA.

Pricing

Pricing will be used-based. During the early access period, usage for KMS APIs is provided at no-costs. Once we enter beta and/or GA, you will be charged based on your stored KMS Keys and API usage.

Get started

1. Sign up or sign in to the Thalassa Cloud console
2. Navigate to KMS in your organisation
3. Create a key in your target region and start encrypting, signing, or hashing

Learn more on the KMS product page or in the KMS documentation.