# Encryption > An index and topic collection covering encryption services, key management systems (KMS), hardware security modules (HSM), envelope encryption, end-to-end encryption SDKs, certificate management, and code/data signing. This topic gathers the cryptographic primitives, managed services, and open-so... This is the **Encryption** topic area of [API Evangelist](https://apievangelist.com) — a network of focused knowledge bases drawn from 16 years of independent API research by Kin Lane. Browse all areas at https://apievangelist.com/areas/. ## Services & Tools - [Amazon KMS](https://providers.apis.io/providers/amazon-kms/) (repo: https://github.com/api-evangelist/amazon-kms) - [Amazon Payment Cryptography](https://providers.apis.io/providers/amazon-payment-cryptography/) (repo: https://github.com/api-evangelist/amazon-payment-cryptography) - [Amazon Private CA](https://providers.apis.io/providers/amazon-private-ca/) (repo: https://github.com/api-evangelist/amazon-private-ca) - [Amazon Signer](https://providers.apis.io/providers/amazon-signer/) (repo: https://github.com/api-evangelist/amazon-signer) - [Apple Pay](https://providers.apis.io/providers/apple-pay/) (repo: https://github.com/api-evangelist/apple-pay) - [Azure Key Vault](https://providers.apis.io/providers/azure-key-vault/) (repo: https://github.com/api-evangelist/azure-key-vault) - [Cosign](https://providers.apis.io/providers/cosign/) (repo: https://github.com/api-evangelist/cosign) - [DigiCert](https://providers.apis.io/providers/digicert/) (repo: https://github.com/api-evangelist/digicert) - [Doppler](https://providers.apis.io/providers/doppler/) (repo: https://github.com/api-evangelist/doppler) - [Google Cloud KMS](https://providers.apis.io/providers/google-cloud-kms/) (repo: https://github.com/api-evangelist/google-cloud-kms) - [Google Cloud Secret Manager](https://providers.apis.io/providers/google-cloud-secret-manager/) (repo: https://github.com/api-evangelist/google-cloud-secret-manager) - [HashiCorp Vault](https://providers.apis.io/providers/hashicorp-vault/) (repo: https://github.com/api-evangelist/hashicorp-vault) - [Let's Encrypt](https://providers.apis.io/providers/lets-encrypt/) (repo: https://github.com/api-evangelist/lets-encrypt) - [Lit Protocol](https://providers.apis.io/providers/lit-protocol/) (repo: https://github.com/api-evangelist/lit-protocol) - [Matrix](https://providers.apis.io/providers/matrix/) (repo: https://github.com/api-evangelist/matrix) - [Notary Project](https://providers.apis.io/providers/notary/) (repo: https://github.com/api-evangelist/notary) - [OpenSSF](https://providers.apis.io/providers/openssf/) (repo: https://github.com/api-evangelist/openssf) - [OpenWallet Foundation](https://providers.apis.io/providers/openwallet-foundation/) (repo: https://github.com/api-evangelist/openwallet-foundation) - [Signal](https://providers.apis.io/providers/signal/) (repo: https://github.com/api-evangelist/signal) - [Sigstore](https://providers.apis.io/providers/sigstore/) (repo: https://github.com/api-evangelist/sigstore) - [SOPS](https://providers.apis.io/providers/sops/) (repo: https://github.com/api-evangelist/sops) - [SPIFFE](https://providers.apis.io/providers/spiffe/) (repo: https://github.com/api-evangelist/spiffe) - [SSH](https://providers.apis.io/providers/ssh/) (repo: https://github.com/api-evangelist/ssh) - [Symantec](https://providers.apis.io/providers/symantec/) (repo: https://github.com/api-evangelist/symantec) - [Symphony](https://providers.apis.io/providers/symphony/) (repo: https://github.com/api-evangelist/symphony) - [Tink](https://providers.apis.io/providers/tink/) (repo: https://github.com/api-evangelist/tink) - [The Update Framework](https://providers.apis.io/providers/tuf/) (repo: https://github.com/api-evangelist/tuf) ## Common Features - **Managed Key Management Services**: Cloud KMS offerings like AWS KMS, Google Cloud KMS, and Azure Key Vault provide managed creation, rotation, and lifecycle of cryptographic keys with hardware-backed protection and IAM-controlled access. - **Hardware Security Module APIs**: Network-attached HSMs and HSM-backed services such as AWS CloudHSM, Azure Dedicated HSM, and Google Cloud HSM expose tamper-resistant cryptographic operations through PKCS#11 and REST APIs. - **Envelope Encryption Patterns**: Envelope encryption wraps data encryption keys (DEKs) with key encryption keys (KEKs) stored in a KMS, enabling scalable encryption of large data sets while centralizing key control. - **End-to-End Encryption Protocols**: Open protocols like Signal, Matrix Olm/Megolm, and MLS provide forward-secret, deniable end-to-end encryption for messaging, calling, and collaboration applications. - **Certificate Lifecycle Automation**: ACME-based services like Let's Encrypt, alongside enterprise CAs like DigiCert and Amazon Private CA, automate issuance, renewal, and revocation of TLS and code-signing certificates. - **Code and Artifact Signing**: Sigstore, Cosign, Notary, and TUF provide keyless and key-based signing of container images, binaries, and software packages with transparency-log-backed verification. - **Secrets and Configuration Encryption**: Tools like HashiCorp Vault, Doppler, and SOPS encrypt secrets, environment variables, and configuration files in transit and at rest, integrating with KMS providers and CI/CD pipelines. - **Open-Source Cryptographic Libraries**: Libraries like Google Tink, libsodium, OpenSSL, and BoringSSL provide misuse-resistant primitives for symmetric, asymmetric, AEAD, hashing, and digital signature operations. ## Use Cases - **Encrypting Data at Rest in the Cloud**: Applications use cloud KMS APIs to encrypt database fields, S3 objects, and disk volumes with envelope encryption, ensuring keys never leave a managed boundary while data ciphertext can be stored anywhere. - **TLS Termination and Certificate Renewal**: Web platforms automate TLS certificate provisioning and rotation through ACME (Let's Encrypt) or enterprise CA APIs (DigiCert, Amazon Private CA), keeping in-transit encryption healthy without manual operations. - **Software Supply Chain Signing**: Build pipelines sign container images and binaries with Sigstore/Cosign, anchoring artifacts to transparency logs so downstream consumers can verify provenance before deploying. - **End-to-End Encrypted Messaging and Collaboration**: Messaging applications integrate Signal protocol, Matrix Olm/Megolm, or MLS to provide forward-secret encryption where neither the service operator nor an attacker can read message content. - **Secrets Management for CI/CD**: HashiCorp Vault, Doppler, and SOPS encrypt secrets used across CI/CD pipelines, source control, and runtime environments, integrating with cloud KMS for sealed storage and audit logging. - **Tokenization and Payment Cryptography**: Payment processors and PCI workloads use services like AWS Payment Cryptography and Apple Pay tokenization to perform PIN translation, card encryption, and EMV operations under FIPS-validated HSMs. - **Workload Identity and Zero-Trust Cryptography**: SPIFFE/SPIRE issue short-lived, cryptographically verifiable workload identities (SVIDs) so services can mutually authenticate without long-lived secrets across multi-cloud environments. ## Related Areas - [Gateway](https://gateway.apievangelist.com): A collection of services, tooling, and open source solutions for API gateway management and traffic control, covering... - [SDKs](https://sdk.apievangelist.com): A curated index of services, tooling, and open source solutions for generating API SDKs, client libraries, and code f... - [FinOps](https://finops.apievangelist.com): FinOps is a cloud financial management discipline combining technology, finance, and business practices to drive acco... - [Management](https://management.apievangelist.com): An index and topic collection covering full-stack API management platforms — solutions that combine an API gateway, d... - [IDE](https://ide.apievangelist.com): An index and topic collection covering integrated development environments (IDEs), code editors, and cloud workspaces... - [Deprecation](https://deprecation.apievangelist.com): API deprecation, sunset headers, end-of-life management, and API retirement practices, including RFC 8594 Sunset, the... ## More - [Latest Encryption stories](/stories/) - [All API Evangelist topic areas](https://apievangelist.com/areas/) - [API Evangelist network index (llms.txt)](https://apievangelist.com/llms.txt)