mirror of
https://github.com/hanzo-apps/hanzo.ai.git
synced 2026-10-30 14:58:08 +00:00
zooqueen
75c4f1f641
The CLI lines on the product pages were written from the product name -- hanzo dns zones, hanzo kms keys -- and several were not commands the binary has. So the command moves into lib/product.ts, which assembles the rest from what is already stated: the catalog names the product and its route, pages.json names what the catalog does not carry, and products-metadata answers for docs, where null means docs publishes nothing and the link drops. Every CLI line in that table was run against the binary. A product absent from it has no command and its page prints none; nothing composes a verb out of a name. Both blocks that draw it import the Product type rather than declaring their own, which leaves the table the only place a command can be written. The catalog also moves out of package.json into pnpm-workspace.yaml, where pnpm reads it, so the versions are stated once.
73 lines
3.7 KiB
TypeScript
73 lines
3.7 KiB
TypeScript
'use client'
|
|
|
|
import { ArrowRight, Cpu, FileCheck, KeyRound, Lock, Network, ShieldCheck } from 'lucide-react'
|
|
import { ProductLanding } from '@/components/product/ProductLanding'
|
|
import { ProductFooter } from '@/components/products/ProductFooter'
|
|
|
|
/**
|
|
* Hanzo HSM, through the ONE product kit.
|
|
*
|
|
* authz, hsm and idv were a third-generation copy of the same page: a plain
|
|
* `<h1>` hero, a feature grid with NO heading above it, and a "Get started
|
|
* with X" card. See LLM.md, "Tailwind is NOT gone".
|
|
*
|
|
* EVERY WORD IS THE ONE THAT WAS HERE. The headless grid is why a section head
|
|
* is now optional in the kit rather than required — these three never had one,
|
|
* and writing three would be writing words nobody chose.
|
|
*/
|
|
|
|
export default function HanzoHSMPage() {
|
|
return (
|
|
<>
|
|
<ProductLanding
|
|
title={"Hanzo HSM"}
|
|
lede={"One interface to the key hardware you already trust — AWS KMS, Azure Key Vault, Google Cloud KMS, or a Zymbit module over PKCS#11. Generate keys, sign with them, and unwrap with them, without the private material ever reaching your process."}
|
|
ctas={[
|
|
{ label: "View on GitHub", href: "https://github.com/hanzoai" },
|
|
]}
|
|
what={{
|
|
pillars: [
|
|
{
|
|
icon: ShieldCheck,
|
|
title: "Keys never leave the hardware",
|
|
body: "Signing and unwrapping happen inside AWS KMS, Azure Key Vault, or a Zymbit secure module. Hanzo holds a handle, never the key.",
|
|
},
|
|
{
|
|
icon: Cpu,
|
|
title: "You send a message, you get a signature",
|
|
body: "The private key is made inside the module and stays there. Your code passes a key id and some bytes and receives a signature back, so there is no moment at which the key exists in your process to be leaked, logged, or written to a core dump.",
|
|
},
|
|
{
|
|
icon: Lock,
|
|
title: "The key that opens the database",
|
|
body: "The password that decrypts an encrypted store is itself stored encrypted, and the module decrypts it at boot. Nothing on the disk, in the environment or in a manifest is enough on its own to read the data.",
|
|
},
|
|
{
|
|
icon: FileCheck,
|
|
title: "Post-quantum, and honest about where it runs",
|
|
body: "ML-DSA-65 is available as a signing algorithm today. On a module with post-quantum firmware it runs inside the boundary like any other key; without one it runs in the process, which is the right answer for a service that has to be quantum-ready before the hardware is, and the wrong one to describe as hardware-backed.",
|
|
},
|
|
{
|
|
icon: Network,
|
|
title: "Threshold signing, where the hardware can do it",
|
|
body: "Some modules can run key generation and signing rounds internally, so no share is ever assembled anywhere. Shares are attested and encrypted at rest, and a share that arrives unattested is refused. Cloud key services cannot do this, and the interface says so rather than pretending.",
|
|
},
|
|
{
|
|
icon: KeyRound,
|
|
title: "Bring the module you already have",
|
|
body: "AWS KMS, Google Cloud KMS, Azure Key Vault, a Zymbit secure compute module over local PKCS#11, or an in-memory signer for development. One Go interface behind all of them, so which module you use is a line of configuration rather than a rewrite.",
|
|
},
|
|
],
|
|
}}
|
|
finalCta={{
|
|
title: "Get started with HSM",
|
|
buttons: [
|
|
{ label: "View on GitHub", href: "https://github.com/hanzoai" },
|
|
],
|
|
}}
|
|
/>
|
|
<ProductFooter slug={"hsm"} name={"HSM"} />
|
|
</>
|
|
)
|
|
}
|