--- name: hs-crypto-regions title: Regions and locations description: You can connect your applications with the IBM Cloud® Hyper Protect Crypto Services by specifying a regional service endpoint. last-updated: 2026-07-01 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Regions and locations {: #regions} IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted. {: deprecated} You can connect your applications with the IBM Cloud® Hyper Protect Crypto Services by specifying a regional service endpoint. {: shortdesc} ## Available regions {: #available-regions} Hyper Protect Crypto Services is available in the following regions and locations: - Dallas, US: `us-south` - Frankfurt, Germany: `eu-de` - London, UK: `eu-gb` - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure - Madrid, Spain: `eu-es` - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure - São-Paulo, Brazil: `br-sao` - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure - Sydney, Australia: `au-syd` - [Deprecated]{: tag-deprecated} - Tokyo, Japan: `jp-tok` - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure - Toronto, Canada: `ca-tor` - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure - Washington DC, US: `us-east` You can create Hyper Protect Crypto Services resources in one of the supported IBM Cloud regions, which represent the geographic area where your Hyper Protect Crypto Services requests are handled and processed. To learn more, see [Locations, tenancy, and availability](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr&format=markdown#availability). Currently, service instances in the `eu-es` region don't support recovery crypto units. When a service instance is provisioned in other supported regions, you are by default enabled with the option to back up your master keys in the recovery crypto units located in the disaster recovery region. For more information, see [Introducing service instance initialization modes](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode&format=markdown#instance-initialization-recovery-crypto-unit). {: note} ## Connectivity options {: #connectivity-options} Hyper Protect Crypto Services offers two connectivity options for interacting with the service APIs. Public endpoints : By default, you can connect to resources in your account over the IBM Cloud public network. Your data is encrypted in transit by using the Transport Security Layer (TLS) 1.2 protocol. Private endpoints : For added benefits, you can also enable [virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&format=markdown) and service endpoints for your infrastructure account. When you enable VRF for your account, you can connect to Hyper Protect Crypto Services by using a private IP that is accessible only through the IBM Cloud private network. : To learn how to connect to Hyper Protect Crypto Services by using a private endpoint, see [Connecting to Hyper Protect Crypto Services on the IBM Cloud private network](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connection&format=markdown). ## Service endpoints {: #service-endpoints} If you are managing your Hyper Protect Crypto Services resources programmatically, see the following table to determine the API endpoints to use when you connect to the [key management service API](https://cloud.ibm.com/apidocs/hs-crypto), Unified Key Orchestrator, [PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref&format=markdown), and [GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref&format=markdown). ### Instance-based endpoints {: #new-service-endpoints} Hyper Protect Crypto Services is continuously replacing port-based API endpoints with instance-based API endpoints. This Endpoint URL scheme change applies to the full set of APIs and all API Endpoints of Hyper Protect Crypto Services created after the corresponding availability date in the following regions listed. | Region | Availability date | Public key management service endpoints | Public Unified Key Orchestrator service endpoints | Public GREP11 service endpoints | | ------------- | ----------- | ---------------------------- |---------------------------- |---------------------------- | | Washington DC | April 12, 2024 | `.api.us-east.hs-crypto.appdomain.cloud` | `.uko.us-east.hs-crypto.appdomain.cloud`| `.ep11.us-east.hs-crypto.appdomain.cloud` | | Dallas | May 8, 2024 | `.api.us-south.hs-crypto.appdomain.cloud` | `.uko.us-south.hs-crypto.appdomain.cloud`| `.ep11.us-south.hs-crypto.appdomain.cloud` | | São-Paulo | May 15, 2024 | `.api.br-sao.hs-crypto.appdomain.cloud` | `.uko.br-sao.hs-crypto.appdomain.cloud`| `.ep11.br-sao.hs-crypto.appdomain.cloud` | | Toronto | May 29, 2024 | `.api.ca-tor.hs-crypto.appdomain.cloud` | `.uko.ca-tor.hs-crypto.appdomain.cloud`| `.ep11.ca-tor.hs-crypto.appdomain.cloud` | | London | June 5, 2024 | `.api.eu-gb.hs-crypto.appdomain.cloud` | `.uko.eu-gb.hs-crypto.appdomain.cloud`| `.ep11.eu-gb.hs-crypto.appdomain.cloud` | | Tokyo | June 19, 2024 | `.api.jp-tok.hs-crypto.appdomain.cloud` | `.uko.jp-tok.hs-crypto.appdomain.cloud`| `.ep11.jp-tok.hs-crypto.appdomain.cloud` | | Madrid | July 2, 2024 | `.api.eu-es.hs-crypto.appdomain.cloud` | `.uko.eu-es.hs-crypto.appdomain.cloud`| `.ep11.eu-es.hs-crypto.appdomain.cloud` | | Frankfurt | July 15, 2024 | `.api.eu-de.hs-crypto.appdomain.cloud` | `.uko.eu-de.hs-crypto.appdomain.cloud`| `.ep11.eu-de.hs-crypto.appdomain.cloud` | {: caption="New public endpoints for supported regions" caption-side="bottom"} {: #table-1} {: tab-title="Public"} {: tab-group="new-region-endpoint"} {: class="comparison-tab-table"} | Region | Availability date | Private key management service endpoints | Private GREP11 service endpoints | | ------------- | ----------- | ---------------------------- |---------------------------- | | Washington DC | April 12, 2024 | `.api.private.us-east.hs-crypto.appdomain.cloud` | `.ep11.private.us-east.hs-crypto.appdomain.cloud` | | Dallas | May 8, 2024 | `.api.private.us-south.hs-crypto.appdomain.cloud` | `.ep11.private.us-south.hs-crypto.appdomain.cloud` | | São-Paulo | May 15, 2024 | `.api.private.br-sao.hs-crypto.appdomain.cloud` | `.ep11.private.br-sao.hs-crypto.appdomain.cloud` | | Toronto | May 29, 2024 | `.api.private.ca-tor.hs-crypto.appdomain.cloud` | `.ep11.private.ca-tor.hs-crypto.appdomain.cloud` | | London | June 5, 2024 | `.api.private.eu-gb.hs-crypto.appdomain.cloud` | `.ep11.private.eu-gb.hs-crypto.appdomain.cloud` | | Tokyo | June 19, 2024 | `.api.private.jp-tok.hs-crypto.appdomain.cloud` | `.ep11.private.jp-tok.hs-crypto.appdomain.cloud` | | Madrid | July 2, 2024 | `.api.private.eu-es.hs-crypto.appdomain.cloud` | `.ep11.private.eu-es.hs-crypto.appdomain.cloud` | | Frankfurt | July 15, 2024 | `.api.private.eu-de.hs-crypto.appdomain.cloud` | `.ep11.private.eu-de.hs-crypto.appdomain.cloud` | {: caption="New private endpoints for supported regions" caption-side="bottom"} {: #table-2} {: tab-title="Private"} {: tab-group="new-region-endpoint"} {: class="comparison-tab-table"} ### Port-based endpoints {: #existing-service-endpoints} | Region | Public key management service endpoints | Public Unified Key Orchestrator service endpoints |Public GREP11 service endpoints | | ------------- | ---------------------------- |---------------------------- |---------------------------- | | Dallas | `api.us-south.hs-crypto.cloud.ibm.com` | `uko.us-south.hs-crypto.cloud.ibm.com`| `ep11.us-south.hs-crypto.cloud.ibm.com` | | Frankfurt | `api.eu-de.hs-crypto.cloud.ibm.com` | `uko.eu-de.hs-crypto.cloud.ibm.com`| `ep11.eu-de.hs-crypto.cloud.ibm.com` | | London | `api.eu-gb.hs-crypto.cloud.ibm.com` | `uko.eu-gb.hs-crypto.cloud.ibm.com`| `ep11.eu-gb.hs-crypto.cloud.ibm.com` | | Madrid | `api.eu-es.hs-crypto.cloud.ibm.com` | `uko.eu-es.hs-crypto.cloud.ibm.com`| `ep11.eu-es.hs-crypto.cloud.ibm.com` | | São-Paulo | `api.br-sao.hs-crypto.cloud.ibm.com` | `uko.br-sao.hs-crypto.cloud.ibm.com` |`ep11.br-sao.hs-crypto.cloud.ibm.com` | |Sydney - [Deprecated]{: tag-deprecated} | `api.au-syd.hs-crypto.cloud.ibm.com` | `uko.au-syd.hs-crypto.cloud.ibm.com`| `ep11.au-syd.hs-crypto.cloud.ibm.com` | | Tokyo | `api.jp-tok.hs-crypto.cloud.ibm.com` | `uko.jp-tok.hs-crypto.cloud.ibm.com`| `ep11.jp-tok.hs-crypto.cloud.ibm.com` | | Toronto | `api.ca-tor.hs-crypto.cloud.ibm.com` | `uko.ca-tor.hs-crypto.cloud.ibm.com` |`ep11.ca-tor.hs-crypto.cloud.ibm.com` | | Washington DC | `api.us-east.hs-crypto.cloud.ibm.com` | `uko.us-east.hs-crypto.cloud.ibm.com`| `ep11.us-east.hs-crypto.cloud.ibm.com` | {: caption="Lists public endpoints for interacting with Hyper Protect Crypto Services APIs over IBM Cloud's public network" caption-side="bottom"} {: #table-3} {: tab-title="Public"} {: tab-group="region-endpoint"} {: class="comparison-tab-table"} | Region | Private key management service endpoints | Private GREP11 service endpoints| | ------------- | ------------------------------------ |------------------------------------ | | Dallas | `api.private.us-south.hs-crypto.cloud.ibm.com` | `ep11.private.us-south.hs-crypto.cloud.ibm.com` | | Frankfurt | `api.private.eu-de.hs-crypto.cloud.ibm.com` | `ep11.private.eu-de.hs-crypto.cloud.ibm.com` | | London | `api.private.eu-gb.hs-crypto.cloud.ibm.com` | `ep11.private.eu-gb.hs-crypto.cloud.ibm.com` | | Madrid | `api.private.eu-es.hs-crypto.cloud.ibm.com` | `ep11.private.eu-es.hs-crypto.cloud.ibm.com` | | São-Paulo | `api.private.br-sao.hs-crypto.cloud.ibm.com` | `ep11.private.br-sao.hs-crypto.cloud.ibm.com` | | Sydney - [Deprecated]{: tag-deprecated} | `api.private.au-syd.hs-crypto.cloud.ibm.com` | `ep11.private.au-syd.hs-crypto.cloud.ibm.com` | | Tokyo | `api.private.jp-tok.hs-crypto.cloud.ibm.com` | `ep11.private.jp-tok.hs-crypto.cloud.ibm.com` | | Toronto | `api.private.ca-tor.hs-crypto.cloud.ibm.com` | `ep11.private.ca-tor.hs-crypto.cloud.ibm.com` | | Washington DC | `api.private.us-east.hs-crypto.cloud.ibm.com` | `ep11.private.us-east.hs-crypto.cloud.ibm.com` | {: caption="Lists private endpoints for interacting with Hyper Protect Crypto Services APIs over IBM Cloud's private network" caption-side="bottom"} {: #table-4} {: tab-title="Private"} {: tab-group="region-endpoint"} {: class="comparison-tab-table"} For more information about authenticating with Hyper Protect Crypto Services, see the following topics: * [Retrieving your instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID&format=markdown) * [Setting up the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api&format=markdown) * [Managing your keys with the Unified Key Orchestrator API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api&format=markdown) * [Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api&format=markdown) * [Performing cryptographic operations with the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-api&format=markdown)