Companies want to stay on AWS/Azure for convenience but need to neutralize CLOUD Act risk — if the provider is compelled to hand over data, it should be encrypted with keys they cannot access
A managed KMS hosted exclusively on EU-sovereign infrastructure that integrates with AWS S3, RDS, and other services via proxy. Data is encrypted/decrypted at the edge with keys the US provider never touches. Includes audit logs and compliance reports for GDPR/DORA
Subscription based on volume of encrypted data and number of integrations ($1000-10000/mo)
The Reddit thread (186 upvotes, 132 comments) demonstrates real, active pain. GDPR fines are existential (up to 4% of global revenue). DORA mandates ICT risk management for financial services. Legal and compliance teams are actively pushing engineering to solve this. The pain is regulatory and legal — not optional. Deducting 2 points because many companies are still in 'kick the can' mode and haven't been forced to act yet.
TAM: ~500K EU enterprises using AWS/Azure/GCP in regulated sectors (finance, healthcare, legal, government, insurance). At $3K/mo average, that's ~$18B TAM. Realistically, SAM is the ~50K mid-to-large EU enterprises with active compliance pressure, yielding ~$1.8B. SOM for a startup in years 1-3 is maybe 100-500 customers, $1.2M-$30M ARR. Solid but not massive — this is a B2B enterprise niche, not a platform play.
Enterprises already pay $50K-$200K/year for Thales. The proposed $1K-$10K/month sits in a sweet spot — cheaper than incumbents but substantial enough to signal seriousness. Compliance-driven purchases have strong budget justification ('we need this or we get fined'). However, many prospects will try to solve this with free/built-in cloud provider tools first (AWS KMS with EU region, etc.), and some will argue that regional deployment alone is sufficient. You'll need to educate on why native cloud KMS is insufficient under CLOUD Act.
This is where the idea gets hard. A solo dev cannot build a production-grade KMS in 4-8 weeks. Key management systems require: HSM integration or equivalent hardware root of trust (not just software keys), FIPS 140-2 certification (takes 6-12 months and $50K-$200K), proxy infrastructure that handles S3/RDS traffic at scale without becoming a bottleneck, zero-downtime key rotation, audit logging that meets regulatory standards, and the operational security to actually host keys (you become a high-value target). An MVP that demonstrates the concept is feasible, but no regulated enterprise will trust their encryption keys to an uncertified startup. The certification and trust gap is the real barrier.
There IS a gap: no one offers a simple, affordable, EU-sovereign KMS specifically designed to wrap AWS/Azure IaaS services with external keys. Thales can do it but is expensive and complex. Fortanix has great UX but is US-based. Eperi only does SaaS, not IaaS. However, AWS XKS (External Key Store) launched in 2022 and lets any external KMS provider integrate — meaning Thales and others are already filling this exact gap for enterprise customers. Your differentiation would need to be: simpler, cheaper, and EU-native. That's viable but not a moat.
Near-perfect subscription fit. Once encryption keys are in your system, migration cost is enormous (re-encrypt everything). Compliance requires continuous key management, rotation, and audit logs. Volume-based pricing scales naturally with customer growth. Churn would be extremely low — switching KMS providers is a multi-month project. This is infrastructure with strong lock-in.
- +Regulatory tailwinds are strong and accelerating — GDPR, DORA, NIS2, Schrems II enforcement all push demand
- +Extreme customer lock-in once adopted — switching KMS providers requires re-encrypting everything
- +Clear pricing gap between expensive incumbents ($50K+/year) and non-existent affordable options
- +AWS XKS and Google EKM provide standardized integration points — you don't need to reverse-engineer cloud APIs
- +Pain is compliance-driven, meaning budget approval is easier ('we need this or we get fined $X')
- +Reddit signal shows real organic demand from practitioners, not just analyst hype
- !Trust bootstrapping is the #1 killer risk — no regulated enterprise will store encryption keys with an unknown startup without certifications (FIPS 140-2, SOC 2, ISO 27001). Getting these takes 6-18 months and significant investment
- !AWS, Azure, and Google are actively building sovereign cloud offerings (AWS European Sovereign Cloud, Azure sovereign regions) that may reduce the need for external KMS
- !Thales or Fortanix could launch a simplified, lower-cost tier that directly competes with your positioning
- !You become a massive attack target — if your KMS is compromised, every customer's data is exposed. The operational security burden is extreme
- !Sales cycles for EU enterprise compliance tools are 6-18 months with multiple stakeholder signoff (legal, CISO, CTO, procurement)
- !FIPS 140-2 certification requires using approved HSMs — you cannot just use software keys in production, which means hardware costs and physical security requirements
EU-headquartered
US-based unified SaaS/on-prem platform for key management, HSM-as-a-service, encryption, and secrets management. Uses Intel SGX confidential computing enclaves so keys are protected even from Fortanix operators. Supports AWS XKS, Azure Managed HSM, Google EKM.
German
German HSM manufacturer offering hardware security modules and key management for on-prem and hybrid cloud. Used by EU governments, telcos, and automotive. Strong presence in PKI, payments, and IoT security.
Swiss company offering HSM-as-a-service
Build an open-source EU-hosted key management proxy that integrates with AWS S3 via XKS (External Key Store). Deploy on Hetzner or OVHcloud (EU-sovereign hosting). Support a single use case first: S3 object encryption with customer-managed keys stored in EU. Provide a Terraform module for one-click setup. Generate basic GDPR compliance reports showing key residency proof. Target 5-10 design partners from the Reddit thread and EU tech communities. Do NOT attempt FIPS certification for MVP — instead, integrate with Securosys or Utimaco HSMs as the hardware root of trust and inherit their certifications.
Open-source core (key proxy + S3 integration) to build trust and community -> Managed hosted service at $500/mo for startups (limited keys, single integration) -> $2K-$5K/mo for mid-market (multiple integrations, audit logs, compliance reports) -> $10K-$25K/mo enterprise tier (dedicated HSM partition, SLA, custom integrations, DORA/NIS2 compliance packages) -> Professional services for large deployments ($150-$300/hr)
6-9 months to first paying customer. Months 1-3: build MVP with S3 XKS integration, deploy on EU infrastructure, recruit design partners. Months 3-6: iterate with design partners, add audit logging and basic compliance reports, begin SOC 2 process. Months 6-9: convert design partners to paid, launch managed service. Months 9-18: expand integrations (RDS, Azure), pursue FIPS certification via HSM partnership. First meaningful revenue ($10K+ MRR) likely at month 12-15.
- “implementing encryption and managing your own encryption keys would be one way to improve data sovereignty”
- “Are you staying on AWS but using additional encryption/key management to address it?”
- “The cloud act still permits the US cloud provider to just shut down your service though”