India-hosted managed hardware security modules for mid-sized fintechs
TL;DR Sealhouse runs hardware security modules in two Indian data centres and rents capacity to payment aggregators, lenders and digital-signature firms that need one but can't staff it. It handles key ceremonies, backups and audit evidence. Clients pay a monthly fee instead of buying and babysitting boxes.
RBI expects a lot from any firm that holds payment keys. Its 2021 payment security direction asks for tamper-proof HSM logs, clustering and secure backups so one box isn't a single point of failure, careful management of master keys, physical custody of the HSM's own keys, and PIN checks done inside the HSM[1]. Payment data must also stay in India[2].
A large bank can staff all of that. A payment aggregator that has just cleared RBI's ₹15 Cr net-worth bar[3] usually can't. It needs two sites, trained key custodians, ceremony scripts and evidence for its annual audit, and each of those depends on a few people. Lose one and the audit can stall.
What it does, in regulatory terms: an outsourced technology service to RBI-regulated firms. Sealhouse holds no licence of its own. The client stays responsible to RBI, and Sealhouse must accept the client's outsourcing and audit terms.
Sealhouse buys certified general-purpose and payment HSMs from established makers and racks them in two Indian data centres. Each client gets dedicated partitions or whole devices, reached over private links. The service covers the bits clients find hardest - key ceremonies with recorded dual control, backup and recovery drills, firmware updates and a quarterly evidence pack mapped to the RBI controls.
Clients start with the jobs they must keep in India, such as card and PIN processing, tokenisation keys and signing keys for digital signatures. They keep using their existing software through standard interfaces. Sealhouse doesn't build its own HSM hardware, because that would add years and certification costs for no gain.
Payers are the CTO or CISO at payment aggregators, prepaid issuers, NBFC lenders, eSign and PKI providers, and mid-sized insurers. Today they buy HSMs outright or use a cloud HSM. The largest cloud provider charges hourly per HSM with nothing upfront[4], and its payment cryptography service lists $1 per active key and $3,000 (about ₹2.9 L) per physical key exchange[5]. My estimate for Sealhouse is ₹2–8 L a month per client, depending on devices and sites.
RBI's payment security direction dates from February 2021[1], and its payment aggregator rules from 2020 brought many new firms under direct supervision[3]. Cloud HSMs have since made renting normal, but global services are run from abroad with global support hours. Indian makers now sell HSMs domestically[6], which gives you a local supply option.
I found no public figure for HSM spending or HSM services in India. The demand is set by regulation - every payment system operator must keep data in India[2], and RBI's direction treats the HSM as a named control[1]. A practical first count is the number of authorised payment aggregators and eSign providers, from RBI's and CCA's published lists.
A large European security maker sells a cloud HSM through a pay-as-you-go platform[7]. The largest cloud provider offers a cloud HSM and a separate payment cryptography service[4][5]. One Indian HSM maker, including payment HSMs, selling through the government's GeM portal[6], but its site doesn't describe a hosted service.
The gap is a fully managed, India-staffed service that takes the ceremonies and audit work off the client's plate.
| Difficulty | Hard (69/100) |
| Starting capital | ₹6–12 Cr |
| Time to launch | 12–18 months |
Capital goes on HSMs and two secure sites before the first rupee of revenue. Trust is slower still, because no payment firm will move its master keys to a new vendor without audits, references and a long proof period. Running ceremonies with zero mistakes is an operations discipline and not a software problem.
Sealhouse holds no licence of its own, but it sells only to RBI-regulated firms, so their rules become yours before the first contract.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
AI should never touch key ceremonies, key release or any access decision. Those stay with named people under dual control.
Want to work out the AI layer for Sealhouse? Talk to Yash →
Here's what can go south -
I'd only touch this with a founding team that has run HSMs or key management in an Indian bank or payment network and can raise venture-scale capital. If you're a first-time founder then it is not the one. Before buying a single device, sign two letters of intent from payment firms that name a monthly fee and an audit timeline.
Plan for roughly ₹6–12 Cr. Certified HSMs, two Indian data centre sites and an experienced key-management team take most of it.
Not a licence of your own. Your RBI-regulated clients stay responsible, so you must meet their RBI security, data storage and outsourcing terms, plus the CERT-In directions.
Yes, wherever regulators want keys held locally. Check your country's payment and data residency rules, and what audit rights banks there demand from vendors.
The free Sealhouse validation kit has the line-by-line capital breakdown, the effort scoring, the RBI and outsourcing checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for payment and lending firms, and 5 assumptions to test. Download the kit →
Thinking about building Sealhouse or something close to it? The make-or-break work is earning enough trust that a regulated firm hands you its master keys. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.