Topic index / 03 entries
Field notes, architecture decisions, and practical guides filed under this recurring subject.
← All topicsSECURITY
23 April 2026 · 7 MIN READ
Your board asks 'is our data safe in the cloud?' The answer is not yes or no — it is a classification decision that maps each workload to the right control tier. Here is the framework, with the metadata exposure gap most teams miss.
CLOUD
05 March 2026 · 14 MIN READ
AWS KMS doesn't allow key material export by design. When an external PKI partner generates keys but doesn't retain them, you're stuck. Here are the four AWS alternatives — CloudHSM, XKS, Private CA, and fixing the process — with a decision framework to pick the right one.
SECURITY
04 February 2026 · 13 MIN READ
XKS protects key material from extraction, but does it protect against legal compulsion to use those keys? Updated with AWS European Sovereign Cloud (GA January 2026).