Thales payShield Cloud HSM is a bare-metal, PCI-compliant payment HSM service that secures cloud and hybrid payment workloads without the cost and complexity of on-prem infrastructure.

Powered by industry-leading payShield 10K hardware, it delivers low-latency cryptographic performance with exclusive, single-tenant control. Cloud-agnostic and subscription-based, payShield Cloud HSM scales on demand, simplifies compliance, and supports seamless migration while enabling banks to accelerate growth with trusted, future-proof payment security.

Benefits of the payShield Cloud HSM

Flexibility

Simplifies sharing of production HSMs across multiple applications, staff and regions

Future Proof

Offers access to the latest certified payShield hardware and software on demand

Scalability

Enables extra HSMs to be added quickly for resilience, backup or capacity

Cloud Agnostic

Works seamlessly with fast connections to all major public cloud providers (including Azure, AWS and GCP)

Cash Flow

Avoids up-front investment by offering a flexible, monthly subscription service to improve cash flow

payShield Cloud HSM

Thales payShield Cloud HSM provides bare-metal, PCI-compliant payment security for cloud and hybrid environments. With exclusive HSM control, low-latency performance, and subscription-based scalability, it helps reduce cost, simplify compliance, and scale payments securely.

Thales payShield is the #1 ranked solution in top Payment HSM solutions.

PeerSpot users give Thales payShield an average rating of 9.5 out of 10.

Hear what experts say

Explore the payShield Cloud Specifications

Card/Mobile Payments Support	payShield Cloud HSM delivers enterprise-grade, PCI-compliant payment security trusted by leading global payment brands, enabling secure, cloud-scale transaction processing and advanced key management across card and mobile payment environments. Core capabilities include: PCI-compliant PIN and card verification for all major payment networks EMV transaction authorization and secure message processing Mobile payment authorization and lifecycle key management Remote Key Loading (RKL) for ATM and POS infrastructures Magnetic stripe and EMV data preparation, personalization, and mobile provisioning
Cryptographic Algorithms	DES and Triple-DES key lengths 112 & 168 bit AES key lengths 128 bit, 192 bit & 256 bit RSA (up to 4096 bits) ECC as defined in FIPS 186-3 (P-256, P-384 & P-521) HMAC, MD5, SHA-1, SHA-2, SHA-224, SHA-256, SHA-384 & SHA-512
Financial Services Standards	ISO: 9564, 10118, 11568, 13491, 16609 ANSI: X3.92, X9.8, X9.9, X9.17, X9.19, X9.24, X9.31, X9.52, X9.97 ASC X9 TR-31, X9.143 ASC X9 TR-34, X9.139 APACS 40 & 70
Host Connectivity	TCP/IP & UDP Secure Host Communications Management option for TLS authenticated sessions on Ethernet host port
Security Approvals	FIPS 140 (for the TASP security subsystem) PCI HSM including RAP AusPayNet GBIC pre-evaluation Bancontact certificate holder

Thales Ranked #1 in ABI Research’s Payment HSM Competitive Ranking

This recognition highlights Thales’ deep-rooted expertise in cryptography, and its trusted payShield HSM product lines used by financial institutions worldwide.

Learn More