The questions a careful reviewer asks.

How is this different from HashiCorp Vault or a cloud secrets manager?

Those are platforms: a service to run, policies to write, agents or SDKs to adopt, and usually a team to own all of it. Arcenkey is a tool. It is for the credentials that sit in scripts and cron jobs on on-premises Linux hosts, in organizations that will not stand up a platform for them. The server has no database, stores no secrets, and installs as one systemd service next to a hardware device.

If Vault is already working well for you, keep it. Arcenkey covers the hosts it never reached.

Why a hardware security module?

Because a software key on disk is one more file to steal. With the YubiHSM 2, the wrap key is generated on the device and never leaves it, so every decryption has to go through hardware you own and can see. That is the property auditors in government and regulated sectors ask for, at a device cost that fits a departmental budget rather than a data-center one.

What happens when a client host is compromised?

The attacker gets what that host was authorized to read, the same as with any agent-based system. What they do not get is the HSM credential, a central store of everyone's secrets, or other hosts' files, which are not on that machine. Host-bound entries copied in from elsewhere stay sealed. Revoking the host is one allowlist change on the server, and the audit log shows exactly what was read and when.

What happens when the server is down?

Reads and writes fail fast with a distinct exit code. Nothing hangs. Listing and inspection still work locally. There is no client-side plaintext cache, on purpose: caching would put secrets back on every host, which is the problem the design exists to remove. The documentation covers the service patterns that ride out an outage, such as fetching at deploy time or fetching at start with a systemd retry.

For availability, run a second server as an active-active secondary with its own HSM. Clients fail over between them on their own.

Does it scale?

It is designed for fleets of servers that fetch credentials at start-up and hold them, not for per-request lookups from a busy application. In that pattern the HSM is never the bottleneck, and there is no central store of secrets to grow with the fleet. It is proven at the scale ICP manages. We publish no numbers beyond what we have measured ourselves.

Is it FIPS validated?

The YubiHSM 2 is offered in a FIPS-validated version. Arcenkey itself has not been through a validation or an independent security assessment yet. We would welcome one, and we would rather it be commissioned independently than have anyone take our word.

What about identity: OIDC, SAML, LDAP?

Not built. Identity in Arcenkey is per-host certificates from a built-in CA, opt-in scoped tokens for tooling, and the local user's identity on shared hosts for attribution. That matches how the target estates run. Directory integration is an obvious next step for a larger product.

Kubernetes? Containers? Cloud?

Not today. Arcenkey targets long-lived Linux hosts, virtual or physical, on your own network, and runs happily in an air-gapped site. It is not built for short-lived workloads.

Which platforms does it run on?

Red Hat Enterprise Linux and its Rocky and Alma relatives, versions 8 through 10, with Windows callers served through an SSH wrapper. Support for additional Linux distributions is planned. The client depends only on Bash and standard system tooling and the server is a single Go binary, so adding a distribution is a matter of packaging and validation rather than a port.

What does the AI-agent story look like?

Machine identities on servers are what Arcenkey does today. An agent that needs a credential on a host is, to Arcenkey, one more caller of the command-line tool with an attributed, audited identity. We have not built anything agent-specific and do not claim to have.

What does expiry actually do?

It is advisory. A secret past its expiry still reads, so a missed rotation never takes production down in the middle of the night. What you get instead is fleet-wide visibility of what is expiring and when, as a list or as JSON, and a reminder when you read it.

Is there a multi-tenant mode?

No. One server and one HSM per organization. An integrator running several customers runs several servers, which is also the right isolation for that job.

How mature is it?

The client has been in daily production use across the infrastructure ICP manages since 2022. The current architecture, with the HSM credential centralized behind one server, shipped in 2026 and has been through a dozen releases since. There are over 160 automated tests, an OpenAPI specification, man pages, and installation guides for both roles.

Can we buy it, or license it?

It is not generally available. Arcenkey is proprietary software wholly owned by ICP, available today only to organizations that hold a direct agreement with ICP, and not offered as a hosted service. The third-party components inside it are Apache-2.0, MIT, and BSD licensed and listed in a notices file, so there is nothing in it that could not travel. See Company for how we think about that.