[ SHORT ANSWER ]
An HSM solves custody — the key material cannot be extracted — and that is worth having. It does not solve authorisation, because an HSM signs whatever an authorised caller presents, and an LLM agent that has been manipulated is still an authorised caller. The useful architecture puts the HSM underneath a layer that decodes the transaction and evaluates policy first.
1Claw wraps data encryption keys with a KEK in GCP Cloud KMS and can split signing keys with Shamir 2-of-3 across multiple HSM providers, so no single HSM compromise yields the key. Above that sits the part that actually constrains the agent: decoding across EVM types 0–4, EIP-712 typed data, Solana, Bitcoin and Tron, guardrails on the decoded inner call, simulation, and approval routing.
[ COMPARISON ]
1Claw vs HSM signing
Capability by capability. A dash means partial or qualified support — read the note.
[ WHEN TO USE ]
Which one is right for you
Most of these are not either/or. Where the competitor is the better answer, we say so.
Use HSM signing when
- You must present a specific single-tenant FIPS 140-2 Level 3 attestation.
- You already operate HSMs and are building the policy layer yourself.
- Regulatory requirements name a particular hardware vendor.
Use 1Claw when
- You want HSM-backed custody without operating HSMs.
- You need transaction decoding and policy above the hardware.
- You want key splitting across providers rather than trusting one.
[ MIGRATION ]
Moving over in three steps
Most teams keep HSM signing for what it is good at and add 1Claw for the agent layer.
- 1Provision signing keys in 1Claw, or import existing material with Key Import.
- 2Enable MPC key splitting if you want no single provider to hold the key.
- 3Attach guardrails and an approval policy, then run in shadow mode before enforcing.
[ FAQ ]
Common questions
Does an HSM stop prompt injection?
No. It stops key theft. A manipulated agent with valid credentials can still ask the HSM to sign; what stops that is decoding and policy above the HSM.
What HSM does 1Claw use?
GCP Cloud KMS and Cloud HSM for key wrapping and JWT signing, with optional Shamir 2-of-3 splitting of signing keys across multiple HSM providers.
Can I bring my own HSM?
Enterprise arrangements can accommodate specific custody requirements — that is a conversation rather than a self-serve feature.
[ RELATED ]
Other comparisons
[ FREE TIER ] 3 vaults · 50 secrets · 2 agents · 100 signatures/mo
Give agents access, not copies
Store the credential once, scope it per agent, and let the agent act without ever holding it.