Skip to main content
Register
Cloud Security

Security you can trust, at the level you choose

Every resource on Exoscale is encrypted at rest and in transit, with strong key management and role-based access from day one. From there, you decide how far to go: manage your own keys with Exoscale KMS, or keep the key material in your own hardware with External Key Store (XKS).
Contact us

Security built into every Exoscale resource


Every resource you create on Exoscale starts encrypted. Compute root volumes, Block Storage, snapshots and Object Storage are encrypted at rest with AES-256 at the server level, so your operating systems and applications need no changes. API and service traffic uses TLS.

On top of this baseline, you decide how much control you want over your keys. Exoscale KMS lets you create, rotate, replicate and delete your own keys, and External Key Store (private preview) keeps the key material in hardware that you operate. IAM policies decide who can use each key, and Audit Trails record every action on your account.

All of this runs in Exoscale data centers across Europe, under an ISO 27001 certified information security management system.

Levels of trust

The first two levels are always on. Each level above gives you more control and asks less trust of your provider.

  1. +

    Protection in use

    Planned

    Confidential Computing will protect data while it is processed.

  2. 4

    Full key sovereignty

    Private preview

    Keep your keys in your own hardware with External Key Store.

  3. 3

    Your keys, your rules

    Optional

    Own and manage your keys with Exoscale KMS.

  4. 2

    Controlled access

    Always on

    Managed keys, role-based access and Audit Trails for every action.

  5. 1

    Protected by default

    Always on

    All your data is encrypted, at no extra cost. See what is encrypted.

Security building blocks

Key Management Service

Key Management Service

Create, rotate and control the keys that protect your data.

Discover
External Key Store

External Key Store Private preview

Back KMS keys with key material from your own HSM.

Discover
Encryption

Encryption

What is encrypted on Exoscale, at rest and in transit.

Discover
IAM

IAM

Roles, API keys and fine-grained access policies, including for KMS keys.

Discover
Audit Trails

Audit Trails

A record of every action taken on your account.

Discover
Compliance

Compliance

ISO 27001 certification, GDPR, and our compliance center.

Discover

Encryption and key management for every workload

From application secrets to regulated workloads, choose the level of key control that each workload needs.

Protect application secrets


Encrypt API tokens, certificates and connection strings directly through the KMS API or CLI, and decrypt them only in the services that need them. IAM policies decide which users and API keys can decrypt, and Audit Trails record every change to your keys.

Encrypt large data sets


For files, backups and database fields, ask KMS for a data key. You encrypt locally at full speed with the plaintext copy and store the wrapped copy next to your data. When a key rotates, older versions stay available to decrypt existing data, so you never re-encrypt large volumes.

Sign code and documents


Sign releases, artifacts and documents with ECDSA, Ed25519 or RSA-PSS, or with ML-DSA, the post-quantum standard from FIPS 204, for signatures that must stay valid for years. Public keys are exported in standard X.509 format, so anyone can verify your signatures offline with OpenSSL and common libraries.

Keep key custody for regulated workloads


Banking, healthcare and public-sector projects often require that your own security team controls the keys. Manage them with Exoscale KMS, or keep the key material in your own HSM with External Key Store (private preview). Show auditors what is encrypted with our encryption overview and compliance center.

Simple, predictable pricing


Encryption at rest and in transit comes with every resource, at no extra cost and with nothing to set up.

Every organization gets one KMS key free. Each additional key is billed at a flat price per key, charged by the hour, and encrypt, decrypt, rotate and replicate operations are included, so your bill does not grow with traffic.

External Key Store is in private preview. Contact us to discuss your setup and the terms of the preview.

See the current prices on our pricing page.

Security features on Exoscale

Explore More Exoscale Services

Build on a European cloud where encryption at rest and in transit is the default, and get expert help when you need it.

Compute Instances

Compute Instances

Flexible virtual machines for general-purpose, memory-intensive or CPU-bound applications. Root volumes of new instances are encrypted at rest by default.

Discover
Block Storage

Block Storage

High-performance volumes for persistent data, with new volumes and their snapshots encrypted at rest by default.

Discover
Simple Object Storage

Simple Object Storage

S3-compatible storage for backups, logs and media, with bucket-level encryption and the option to bring your own keys with SSE-C.

Discover
Managed Databases

Managed Databases

Fully managed open-source databases with TLS-encrypted connections and automated backups encrypted at rest.

Discover
Kubernetes

Scalable Kubernetes Service

Production-ready Kubernetes clusters with role-based access, Kubernetes audit logs and minimal exposure by default.

Discover
Support Plans

Support Plans

Expert guidance from Exoscale engineers in Europe, with guaranteed response times for your security and compliance projects.

Discover

Talk to us about your key management requirements

Tell us what your auditors or regulators ask for, and we will show you which level of key control fits.

Contact us

Frequently asked questions about security on Exoscale

What is encrypted on Exoscale by default?

New Compute root volumes, Block Storage volumes and snapshots, Object Storage, and instance snapshots and templates are encrypted at rest with AES-256. API and service traffic uses TLS. Existing Block Storage volumes are not re-encrypted. See Encryption for the full list.

How much do Exoscale security services cost?

Encryption at rest and in transit is included at no extra cost. Every organization gets one KMS key free, and additional keys are billed at a flat price per key, charged by the hour, with all operations included. External Key Store is in private preview, so contact us to discuss terms. See the current prices on our pricing page.

What is the difference between default encryption, KMS and External Key Store?

Default encryption protects your data with keys that Exoscale manages, with nothing to set up. Exoscale KMS lets you create and control your own keys: rotation, zones and deletion. External Key Store goes one step further and keeps the key material in a key manager that you run, such as an HSM in your data center.

Do I need to change my applications to use encryption at rest?

No. Encryption at rest is applied at the hypervisor layer, below the guest operating system, so it is transparent to your operating systems and applications. It applies from the moment an instance or volume is provisioned.

Can I use my own keys with Object Storage, Block Storage or Compute?

Object Storage already supports SSE-C, where you provide the encryption key with each request. KMS integration for Object Storage, Block Storage and Compute is coming soon. Today you use KMS keys from your own applications through the API, CLI and SDKs.

How do I control who can use my keys?

With IAM roles and policies, you decide which users and API keys can use, manage or delete each KMS key. Audit Trails record every key management operation, such as creating, rotating or deleting a key. Logging of encrypt and decrypt operations is coming soon.

Where are my data and keys stored?

Your data stays in the European Exoscale zone you choose. KMS keys are stored in the zone where you create them and in the zones you replicate them to. Keys in an External Key Store never leave your own key manager.