Skip to content

HelixIAM by KubeDNA

Book a technical demo Demo

Security & key custody

Keys you hold. Tokens that are hard to misuse.

Per-tenant signing keys in your HSM or Vault, sender-constrained tokens, and an audit trail you can stream to your SIEM.

Request an architecture consultation Visit the trust centre

What you get

Key custody

Choose per realm how far signing keys are kept from the server, up to keys generated and used only inside your HSM.

Keep signing keys in your HSM over PKCS#11
Keys in HashiCorp Vault or OpenBao Transit
Per-tenant signing keys with safe rotation; bring your own CA-signed keys
A dedicated HSM partition or Vault credential per tenant
Rotate key-encryption keys online, without downtime

Hardened tokens

Supports high-security profiles: mTLS-bound tokens, PS256, PAR and DPoP.

Sender-constrained tokens with DPoP
Pushed authorization requests (PAR)
Audience-restricted tokens with resource indicators

Audit and governance

A searchable audit log of sign-ins and admin changes.

Stream audit events to your SIEM over HTTPS, with HMAC-signed webhooks
Fine-grained admin permissions
Built-in GDPR data export and erasure per user

Supply chain

Every release is cosign-signed with an attested SBOM.

Static analysis, dependency and image scanning on every change
Argon2id password hashing, lockout and breached-password checks
See the trust centre for the full process

Review HelixIAM with your security team.

An architecture consultation on key custody, token profiles and audit — and our security pack.

Request an architecture consultation Visit the trust centre