Your Azure keys, held in Europe
Duration: 2:39English
Lumen Pay's data is in Azure. With External Key Management (EKM), Azure Key Vault Managed HSM keeps only a reference to the key and has to ask QuantumAPI, in the EU, for every wrap and unwrap. The QuantumAPI portal shows the Azure connection and the key: generated from quantum randomness (ANU QRNG) and stored at rest under ML-KEM-768, and only the HSM's own client certificate may call. From the terminal, the connection check answers QuantumAPI, the HSM key is only a reference, and a 32-byte data key is wrapped and unwrapped with the same result. Key activity lists every call with its latency. Then the kill switch: Disconnect in the portal, and the same unwrap fails and is logged as Denied; Reconnect, and it works again. The link between Azure and QuantumAPI is standard TLS; what is quantum is how the key is made and stored. External Key Stores is a preview.