When a bank’s systems are breached, the most valuable thing an attacker can steal is not the data — it is the keys that lock and unlock the data. Every payment, every tokenised card number, every Aadhaar authentication eventually passes through a single hardened physical device whose entire job is to generate, store and use cryptographic keys without ever exposing them. That device is the hardware security module — the HSM — and in India, almost all of them were imported.
A Mumbai-headquartered company has spent eight years building the domestic alternative. The company is JISA Softech Pvt. Ltd., and its flagship is CryptoBind — a network-attached HSM that the company describes as India’s first indigenous hardware security module from an Indian OEM. On 9 October 2026, at Pragati Q-Foundry 2026 in New Delhi — the National Quantum Mission’s industry event, held with the Department of Science & Technology and the Data Security Council of India — the company unveiled QuLens + CryptoBind as an integrated Indigenous Quantum Cryptography Trust Platform: hardware-backed key security fused with a cryptographic-governance platform for the post-quantum era.
The hardware: a certified root of trust
An HSM is a tamper-resistant appliance that executes every critical cryptographic operation — encryption, decryption, authentication, key generation and key exchange — inside a sealed boundary, so keys never exist in readable form in ordinary server memory. JISA calls the HSM the “root of trust” in an organisation’s security infrastructure, and its CryptoBind CNN35XX family is designed to scale from a few hundred operations per second to, with appliances chained together, what the company says is up to 700,000 RSA operations per second and a million-key store.
The engineering claim that matters most is certification. The company says the CryptoBind HSM family is FIPS 140-3 Level 3 certified — the current US federal standard for cryptographic modules, with Level 3 adding physical tamper-resistance requirements — and that its cryptographic boundary is EAL4+ compliant under the Common Criteria scheme. The listed specs include up to 35,000 2048-bit RSA operations per second per appliance, up to one lakh keys held inside the FIPS boundary, up to 1,000 partitioned HSMs per physical appliance, and standard PKCS#11, JCE, OpenSSL and REST API interfaces.
The company says its HSMs are already installed at the Indian banking regulator and at other government and private organisations — a deployment footprint that matters in a sector where procurement decisions hinge on trust and sovereign control of the cryptography stack. The products are listed for procurement through the Government e-Marketplace (GeM) portal, and the company is DPIIT-recognised as a Make in India product.
The software: knowing every key before the quantum deadline
CryptoBind’s newer sibling is QuLens, described as “a JISA Softech company” and launched earlier at the Global Fintech Fest 2026. QuLens is a cryptographic-governance and post-quantum-readiness platform: CertiLife handles certificate lifecycle management — discovery, inventory, renewal, rotation and revocation across on-premises, cloud and hybrid estates — while CertiLife+ adds a cryptographic bill of materials (CBOM) that discovers every cryptographic asset, scores its risk and drives a structured migration to NIST’s post-quantum algorithms (ML-KEM, ML-DSA), aligned with RBI, SEBI, CERT-In and NIST guidance.
More Read
The pairing is deliberate. Quantum computers capable of breaking today’s public-key cryptography do not exist yet — but data harvested now can be decrypted later, so banks, insurers and government bodies are being pushed to inventory their cryptographic exposure today. QuLens gives them that inventory; CryptoBind gives them the hardware to back the new algorithms, in what the company describes as an indigenous, FPGA-based quantum-safe HSM platform.
Watch: CryptoBind’s Digital Insights series explains why encryption-key management is the foundation of cryptographic security.
Why it matters
Cryptographic infrastructure is the least visible layer of national digital sovereignty — and the hardest to replace. A certified, indigenously built HSM family, deployed in the banking regulator’s own estate and paired with a post-quantum migration platform unveiled under the National Quantum Mission’s banner, is exactly the kind of unglamorous, load-bearing engineering that makes every other Indian technology bet safer.
