CoreSec KMS
A self-contained key management appliance for the whole CoreCx estate. Recordings kept today stay safe from harvest-now-decrypt-later attacks, and no single person ever holds the root secret.
Post-quantum key management that keeps your recordings yours.
Quantum-safe today
FIPS 203 ML-KEM with a hybrid mode that holds unless both algorithms are broken.
No single point of trust
The root secret is split between two custodians, verifiable without disclosure, with offline recovery.
Rotate without regret
Each recording is pinned to its key.
What CoreSec KMS does for you
Quantum-safe today
FIPS 203 ML-KEM with a hybrid mode that holds unless both algorithms are broken.
- ML-KEM
- Hybrid mode
- AES-256-GCM envelopes
No single point of trust
The root secret is split between two custodians, verifiable without disclosure, with offline recovery.
- Two custodians
- Verifiable shares
- Offline recovery
Rotate without regret
Each recording is pinned to its key. Archived or revoked keys still decrypt, and destruction is provable.
- Key pinning
- Archived keys decrypt
- Provable destruction
Zero-trust operations
Deny-by-default access, scoped service tokens, directory sign-in and a single exposed port. Recorders never wait on the KMS.
- Deny by default
- Directory sign-in
- No per-call round trip
Works with what you run
Built in, not bolted on
- Modern TLS with forward secrecy only
- Sandboxed non-root services
- Reproducible builds with signed manifests
- Published vulnerability assessment
Where CoreSec KMS makes the difference
Keys no vendor and no single employee can use
Encryption keys sit with the application vendor or with one administrator who could walk out with them.
The root secret is split between two custodians, every private key is sealed in an AES-256-GCM envelope, and the appliance exposes a single port.
HSM-centric products are expensive and still trust one operator. CoreCx is a software appliance with split custody and published limits.
Become quantum-safe before the regulator asks
Boards are asking for a post-quantum plan and nobody wants to re-encrypt a decade of recordings later.
FIPS 203 ML-KEM wraps every recording key from day one, with a hybrid mode that holds unless both algorithms are broken.
Most recording platforms have no post-quantum roadmap. CoreCx ships it today.
See what else you can do with CoreCx
iFlux Recorder
Multivendor call recording, compliance-grade and sealed the moment every call is written.
Learn moreiFlux Secure Search & Replay
Retire the legacy recorder. Keep every recording.
Learn moreCoreCx EL
The hardened operating system every CoreCx product runs on, secure from the first boot.
Learn morePut CoreSec KMS to work on your own infrastructure
A pilot against your real telephony, on your hardware, in days.
Frequently asked questions about CoreSec KMS
What does CoreSec KMS do?
A self-contained key management appliance for the whole CoreCx estate. Recordings kept today stay safe from harvest-now-decrypt-later attacks, and no single person ever holds the root secret.
Can CoreSec KMS run on-premise or in your own cloud?
Both. Most customers install it on-premise from a signed offline bundle, with no internet connection needed. You can also bring your own cloud and run it in your own cloud subscription. Wherever it runs, it never sends your data back to CoreCx.
What does CoreSec KMS integrate with?
iFlux Recorder, iFlux Secure Search & Replay, Directory and single sign-on, SNMPv3 monitoring, CoreCx EL hosts.
How is CoreSec KMS secured?
Modern TLS with forward secrecy only. Sandboxed non-root services. Reproducible builds with signed manifests. Published vulnerability assessment.