---
name: security-hub-service-comparison
title: Which secrets management product should you use?
description: With IBM Cloud, you can choose from various secrets management and data protection offerings that help you to protect your sensitive data and centralize your secrets. If you need to integrate general-purpose secrets to authenticate your apps, you can use Secrets Manager to create dynamic secrets and manage their lifecycle. But for other application secrets, such as encryption keys, your business might require a higher level of control that relies on highly secure, customer-controlled cryptographic hardware.
last-updated: 2026-06-25
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/security-hub?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Which secrets management product should you use?
{: #manage-secrets-ibm-cloud}


With IBM Cloud, you can choose from various secrets management and data protection offerings that help you to protect your sensitive data and centralize your secrets. If you need to integrate general-purpose secrets to authenticate your apps, you can use Secrets Manager to create [dynamic secrets](#x9968958){: term} and manage their lifecycle. But for other application secrets, such as encryption keys, your business might require a higher level of control that relies on highly secure, customer-controlled cryptographic hardware.
{: shortdesc}

For example, consider the following scenarios to learn about how they map to secrets management offerings and data protection offerings in IBM Cloud.

![The image describes three use cases for secrets management and how they map to available services in IBM Cloud. The content is explained fully in the surrounding text.](/images/secrets-mgmt-options.svg){: caption="Secrets management use cases" caption-side="bottom"}

The diagram shows three secrets management use cases and the IBM Cloud service recommended for each. If you want to manage secrets and credentials to access resources, use **Secrets Manager**. If you want to manage symmetric keys to encrypt data at rest, use **Key Protect** or **Hyper Protect Crypto Services**. If you want to manage SSL/TLS certificates to secure data in transit, use **Secrets Manager**.

## Which data protection service is best for you?
{: #which-data-protection-service}

The following table lists the different offerings that you can use with IBM Cloud to protect your application secrets.

| Scenario | What to use |
| --- | --- |
| As a DevOps team contributor, you need to create, lease, and manage API keys, credentials, database configurations, and other secrets for your services and applications. | With **[Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?format=markdown)**, you can manage secrets of various types in a dedicated instance. |
| You need to generate, renew, and manage SSL/TLS certificates for your deployments. | You can also manage your SSL/TLS certificates and private keys in a dedicated instance of **[Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?format=markdown)**. |
| You need to create and manage encryption keys that are backed by FIPS 140-2 Level 3 validated hardware. | You can use **[Key Protect](https://cloud.ibm.com/docs/key-protect?format=markdown)** to generate and import encryption keys by using a multi-tenant service with shared hardware. |
| You are an admin in an industry, such as finance or legal, that must adhere to governance over how data is protected and isolated. You need to create and manage encryption keys by using a dedicated, FIPS 140-2 Level 4 hardware security module that you control and manage. | With **[Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?format=markdown)**, you can manage encryption keys in a single-tenant service with dedicated hardware. |
| You need a way to offload TLS handshake encryption to a dedicated, FIPS 140-2 Level 4 hardware security module that you control and manage. | You can also use **[Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?format=markdown)** to control your TLS/SSL keys in a dedicated HSM. |
{: caption="Data protection scenarios" caption-side="top"}

## What are the key secret types supported by each data protection service?
{: #key-features}

As you plan your data protection strategy, some differences between services to consider include the level of data isolation that your workload requires, and the secret types that you can use.

For a higher level of security and control, your business might benefit from the data isolation that a single-tenant offering provides, such as Secrets Manager or Hyper Protect Crypto Services. You might also decide that the reduced cost and scalability benefits of a multi-tenant service, such as Key Protect, are better suited to your needs. The following table lists key features for each service.

| Service | Secret types | Multi-tenant[^multi-tenant] | Single-tenant[^single-tenant] | HSM backed[^hsm] |
| --- | --- | --- | --- |  --- |
| **Secrets Manager** | Arbitrary secrets  \n IAM credentials  \n Service credentials \n Key-value secrets  \n SSL/TLS certificates  \n User credentials | | ![Checkmark icon](../../icons/checkmark-icon.svg)| |
| **Key Protect** | Symmetric encryption keys | ![Checkmark icon](../../icons/checkmark-icon.svg)| | ![Checkmark icon](../../icons/checkmark-icon.svg) | |
| **Hyper Protect Crypto Services** | Symmetric and asymmetric encryption keys | |![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) |
{: caption="Key features for IBM Cloud data protection services" caption-side="top"}
{: summary="The table compares features across Secrets Manager, Certificate Manager, Key Protect, and Hyper Protect Crypto Services. The first column lists the names of the services. The second column lists the types of secrets that are supported by each service. The third column uses checkmarks to indicate whether a service is multi-tenant. The fourth column uses checkmarks to indicate whether a service is single-tenant. The last column uses checkmarks to indicate whether a service is backed by a hardware security module (HSM)."}
{: class="comparison-table"}

[^multi-tenant]: A multi-tenant service uses a single instance of its software (and its underlying database and hardware) to serve multiple tenants. [Learn more](https://www.ibm.com/think/topics/multi-tenant){: external}.

[^single-tenant]: A single-tenant service creates a dedicated instance of its software (and its underlying database and hardware) for each individual tenant.

[^hsm]: A service that is backed by a hardware security module (HSM) uses tamper-resistant, FIPS-validated physical hardware as its root of trust for cryptographic storage and processing of encryption keys.

## How do I get started?
{: #get-started-data-protection}

Each service supports either a Lite plan or a Trial trial that you can use to try its service capabilities for free. Get started by creating an instance of a service from the IBM Cloud catalog.

- [Key Protect](https://cloud.ibm.com/catalog/services/key-protect){: external}
- [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hs-crypto){: external}
- [Secrets Manager](https://cloud.ibm.com/catalog/services/secrets-manager){: external}