Edit

What is Azure Payment HSM v2?

Azure Payment HSM v2 is a highly available, single-tenant payment hardware security module (HSM) service for payment processing, credential issuance, personal identification number (PIN) processing, key management, and authentication data protection. You keep exclusive administrative control of an isolated, single-tenant payment HSM cluster while Microsoft manages the underlying infrastructure, availability, and lifecycle operations. Azure Payment HSM v2 helps you protect sensitive payment assets, maintain key sovereignty, and meet the stringent security, compliance, audit, performance, and operational requirements of the Payment Card Industry (PCI).

Important

Azure Payment HSM v2 is currently in preview and is delivered through a gated onboarding model. During preview, the service is available in the West US and West Europe regions. To deploy or use the service, engage your Microsoft account manager or Microsoft Customer Support to have your Azure subscription registered and enabled. The preview is available at no charge. To get started, see Create a Payment HSM v2.

Note

Azure Payment HSM v2 is a separate service from Azure Payment HSM, which uses Thales payShield 10K hardware. The two services coexist. If you need general-purpose cryptographic key storage rather than payment-specific operations, see Azure Cloud HSM.

Azure Payment HSM v2 high-level architecture

After provisioning, the Azure Payment HSM v2 cluster is integrated directly into your Azure virtual network, enabling secure remote administration and operation. You manage payment cryptographic workloads through the Utimaco Atalla Payment Module software interface, which provides payment-specific command sets and capabilities including PIN processing, EMV transaction support, and key management.

Diagram that shows payment applications and HSM administration connecting through private endpoints to an Azure Payment HSM v2 cluster.

Why use Azure Payment HSM v2?

Payment systems are undergoing rapid modernization as financial institutions, payment processors, fintech providers, and digital-native organizations seek to increase agility, improve resilience, and reduce the operational complexity of traditional payment infrastructure. Managing payment HSM hardware, capacity planning, lifecycle maintenance, high availability, and compliance operations can introduce significant operational overhead and slow the delivery of new payment services.

Azure Payment HSM v2 removes this overhead. You get a cloud-native, highly available payment HSM cluster in Azure while keeping exclusive control of your keys and cryptographic operations. Azure Payment HSM v2 helps organizations address common payment infrastructure challenges, including:

  • Scale payment cryptography capacity without deploying or managing physical HSM appliances.
  • Simplify high availability and resilience for critical payment workloads.
  • Reduce operational overhead from HSM lifecycle management and capacity planning.
  • Accelerate delivery of new payment services and applications.
  • Preserve key sovereignty, auditability, and compliance across payment workloads.

Enhanced security and compliance

Azure Payment HSM v2 runs in PCI DSS and PCI 3DS compliant Azure data centers, on security infrastructure certified to FIPS 140-3 Level 3, PCI DSS, PCI 3DS, and PCI PIN. Because payment HSM clusters are isolated per customer, you can deploy the service as a validated component within your own PCI solution, simplifying ongoing audit and compliance.

Administrative and single-tenant control

Each subscription provides a single-tenant HSM cluster under your complete administrative control, whether you're a payment service provider acting for multiple financial institutions or a financial institution accessing the service directly. Microsoft has no access to customer data. When a cluster is released, customer data is zeroized and erased to preserve privacy. You're responsible for maintaining enough active HSM capacity to meet your backup, disaster recovery, and resilience targets.

Accelerate digital transformation and innovation in cloud

Azure Payment HSM v2 lets financial institutions, payment processors, and service providers modernize payment cryptography without procuring, deploying, or scaling physical HSM hardware. Isolated, single-tenant HSM clusters deliver low latency, high availability, and the performance that mission-critical payment workloads demand.

The service integrates directly into your Azure virtual network and supports the full range of PCI-regulated functions, including key management, PIN processing, EMV operations, and credential issuance, so your teams can focus on delivering payment services rather than managing infrastructure.

Service maintenance

Azure Payment HSM v2 has no scheduled maintenance windows. Microsoft might perform maintenance for necessary upgrades or faulty hardware replacement and notify you in advance of any anticipated impact.

Typical use cases

Azure Payment HSM v2 provides low latency and lets you add resources as demand grows. Typical use cases include:

  • Payment processing
  • Card and mobile payment authorization
  • PIN and EMV cryptogram validation
  • 3D-Secure authentication

Payment credential issuing:

  • Cards
  • Mobile secure elements
  • Wearables
  • Connected devices
  • Host card emulation (HCE) applications

Securing keys and authentication data:

  • POS, mPOS, and SPOC key management
  • Remote key loading (for ATM and POS/mPOS devices)
  • PIN generation and printing
  • PIN routing

Sensitive data protection:

  • Point-to-point encryption (P2PE)
  • Security tokenization for PCI DSS compliance
  • EMV payment tokenization

Suitable for both existing and new payment HSM users

This service is suitable for established payment HSM users who want administrative control at cloud scale and for new entrants that want to adopt a cloud-native approach.

Modernize an existing payment environment:

  • The service simplifies payment infrastructure modernization.
  • The service centralizes payment cryptography management across distributed teams and applications.
  • The service reduces the operational overhead of deploying, managing, and scaling payment HSM hardware.
  • The service provides highly available payment HSM clusters that integrate directly into Azure virtual networks.
  • You can increase capacity without extra physical infrastructure planning.

Build a cloud-native payment platform:

  • You don't need to buy or operate on-premises HSM hardware.
  • The service delivers isolated, single-tenant payment HSM capacity through an Azure consumption model.
  • The service provides enterprise-grade security, availability, and compliance from day one.

Glossary

Term Definition
3DS 3D Secure
APM Atalla Payment Module
ATM Automated Teller Machine
EMV Euro Mastercard Visa
FIPS Federal Information Processing Standards
HCE Host Card Emulation
HSM Hardware Security Module
mPOS Mobile Point of Sale
P2PE Point-to-Point Encryption
PCI Payment Card Industry
PIN Personal Identification Number
POS Point of Sale
SPOC Software-based PIN Entry on Commercial off the Shelf (COTS) Solutions

Related content

  • Last updated on