Small fintech team: when should we bring in HSM/KMS specialists instead of relying on managed cloud HSM?
We’re a small B2B payments/software company, 8 people total. Mostly backend/product, no full-time security engineer yet. Up to now we’ve mostly built around payment APIs and processor integrations, but starting to talk with larger financial clients who ask more serious questions about encryption, key custody, audit logs, rotation, PCI scope, HSM-backed operations, etc.
We are not processing PINs ourselves, and we’re definitely not trying to roll our own crypto. But clients/partners are asking whether our platform can support proper HSM software development workflows and longer-term Key management systems (KMS) development - things like secure key generation, key storage, key rotation, access controls, auditability, and maybe EMV/PIN block type stuff later.
For a small fintech at our stage, what’s the practical path here?
Is it normal to start with managed/cloud HSM or cloud KMS, with help from a consultant, or do banks/processors usually expect physical payment HSM setups like Thales/Utimaco/Futurex once you get serious?
Some things I need to know now:
- What mistakes do early fintech teams usually make with key management architecture?
- Should HSM/KMS design be done before PCI planning, or is it normal to work it out during PCI prep?
- If we hire outside help, how do we tell if they actually understand payment HSMs and KMS development, not just general cloud security?
- Are there clear red flags where we should stop building internally and bring in specialists immediately?
I’m asking because bad key management seems like one of those things that looks fine in MVP stage, but becomes too massive problem once banks / processors / auditors start digging into it.
Would love to hear from anyone who’s gone through this complicated transition before. What would you do differently if you were a small team starting again?