hanzo.ai/app/(marketing)/hsm/page.tsx

'use client'

import { ArrowRight, Cpu, FileCheck, KeyRound, Lock, Network, ShieldCheck } from 'lucide-react'
import { ProductLanding } from '@/components/product/ProductLanding'
import { ProductFooter } from '@/components/products/ProductFooter'
import { useI18n } from '@hanzo/i18n/react'

/**
 * Hanzo HSM, through the ONE product kit.
 *
 * authz, hsm and idv were a third-generation copy of the same page: a plain
 * `<h1>` hero, a feature grid with NO heading above it, and a "Get started
 * with X" card. See LLM.md, "Tailwind is NOT gone".
 *
 * EVERY WORD IS THE ONE THAT WAS HERE. The headless grid is why a section head
 * is now optional in the kit rather than required — these three never had one,
 * and writing three would be writing words nobody chose.
 */

export default function HanzoHSMPage() {
  const { t } = useI18n()
  return (
    <>
      <ProductLanding
        title={"Hanzo HSM"}
        lede={t("One interface to the key hardware you already trust — AWS KMS, Azure Key Vault, Google Cloud KMS, or a Zymbit module over PKCS#11. Generate keys, sign with them, and unwrap with them, without the private material ever reaching your process.")}
        ctas={[
          { label: t("View on GitHub"), href: "https://github.com/hanzoai" },
        ]}
        what={{
          pillars: [
            {
              icon: ShieldCheck,
              title: t("Keys never leave the hardware"),
              body: t("Signing and unwrapping happen inside AWS KMS, Azure Key Vault, or a Zymbit secure module. Hanzo holds a handle, never the key."),
            },
            {
              icon: Cpu,
              title: t("You send a message, you get a signature"),
              body: t("The private key is made inside the module and stays there. Your code passes a key id and some bytes and receives a signature back, so there is no moment at which the key exists in your process to be leaked, logged, or written to a core dump."),
            },
            {
              icon: Lock,
              title: t("The key that opens the database"),
              body: t("The password that decrypts an encrypted store is itself stored encrypted, and the module decrypts it at boot. Nothing on the disk, in the environment or in a manifest is enough on its own to read the data."),
            },
            {
              icon: FileCheck,
              title: t("Post-quantum, and honest about where it runs"),
              body: t("ML-DSA-65 is available as a signing algorithm today. On a module with post-quantum firmware it runs inside the boundary like any other key; without one it runs in the process, which is the right answer for a service that has to be quantum-ready before the hardware is, and the wrong one to describe as hardware-backed."),
            },
            {
              icon: Network,
              title: t("Threshold signing, where the hardware can do it"),
              body: t("Some modules can run key generation and signing rounds internally, so no share is ever assembled anywhere. Shares are attested and encrypted at rest, and a share that arrives unattested is refused. Cloud key services cannot do this, and the interface says so rather than pretending."),
            },
            {
              icon: KeyRound,
              title: t("Bring the module you already have"),
              body: t("AWS KMS, Google Cloud KMS, Azure Key Vault, a Zymbit secure compute module over local PKCS#11, or an in-memory signer for development. One Go interface behind all of them, so which module you use is a line of configuration rather than a rewrite."),
            },
          ],
        }}
        finalCta={{
          title: t("Get started with HSM"),
          buttons: [
            { label: t("View on GitHub"), href: "https://github.com/hanzoai" },
          ],
        }}
      />
      <ProductFooter slug={"hsm"} name={"HSM"} />
    </>
  )
}