What Cryptomathic does

Cryptomathic, founded in 1986 and headquartered in Aarhus, Denmark, is a privately held provider of cryptographic security software solutions serving regulated enterprises globally. Its product portfolio spans eight product families: key and certificate lifecycle management (CKMS, CSG, CrystalKey 360, TrustView, TrustView Lite), mobile application security (MASC Core and MASC Assurance), digital identity and qualified electronic signatures (Signer, Managed Signing Services, National Signing Services), and payment card infrastructure (Obsidian CA/Issuance/PIN/Transact, CardInk). Core technology is built on FIPS 140-2 Level 3 compliant hardware security module (HSM) infrastructure, with the Crypto Service Gateway providing vendor-neutral abstraction across HSM vendors (Utimaco, Thales, nCipher, SafeNet, Entrust) and API standards (PKCS#11, JCE, CNG, CSP, RESTful).

The company's go-to-market is enterprise-focused and consultative, with quote-based pricing and direct field sales through regional offices in Denmark, the UK, Germany, and the US, supplemented by channel partners (PQ Shield, LANACO, Scrive, INSTA, SDC) and technology alliances (Utimaco, Thales, Entrust, AWS, Infosec Global). Revenue derives primarily from enterprise software licenses and subscriptions, professional services for complex cryptographic deployments, and usage/subscription components within the Signer qualified electronic signature offering. Primary customer segments are banking and financial institutions, fintech providers, trust service providers, and government/public sector organizations, with stated expansion into healthcare, pharma, legal, retail, and transit verticals. Named customers include Barclays, UBS, Crédit Agricole (CEDICAM), Elan Financial Services, LuxTrust, Swisscom, Scrive, and the Belgian Federal Public Service for ICT (BOSA).

In December 2024, Cryptomathic secured a partnership and investment from Riverside and institutional co-investors, explicitly to support international expansion. The company previously acquired Aconite Technology in May 2019 to extend its EMV and payment issuance capabilities. Its current strategic emphasis is on post-quantum cryptography readiness, crypto-estate consolidation, and alignment with the EU Digital Identity (EUDI) regulatory framework.

Name

Cryptomathic

Legal name

Cryptomathic A/S

Website

https://cryptomathic.com

Company type

Private

Founded year

1986

Operating status

Operating

Headcount range

101–250 employees

Short description

Cryptomathic, founded in 1986 and headquartered in Denmark, provides enterprise cryptographic security software — including key management, mobile application protection, qualified electronic signatures, and EMV payment infrastructure — to banks, governments, trust service providers, and fintechs globally.

Ownership category

akta.pro rank

Product category

Cryptographic Security Software

NAICS

Computer Systems Design and Related Services (54151), Security Systems Services (except Locksmiths) (561621), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

MPC / HSM / Key Management Infrastructure (FSADACAC)

Keywords

• Cryptographic key management
• Digital signature solutions
• Mobile application security
• EMV card issuance
• Certificate lifecycle management

Headquarters

HQ city

Århus

HQ country

Denmark

HQ region

Europe

Offices4 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure, Supply Chain

Revenue model

1. Enterprise Software Licenses and Subscriptions: Cryptomathic sells enterprise-grade cryptographic software solutions to financial institutions, governments, and trust service providers. The solutions are typically deployed as enterprise software with potential subscription/maintenance components for ongoing support, updates, and cloud services.
2. Professional Services and Implementation: The company provides consulting and implementation services to deploy cryptographic solutions, as evidenced by the Tier 1 Bank case study and white paper downloads suggesting custom integration work.
3. Qualified Signing Services: Signer solution enables qualified trust service providers and organizations to create qualified remote electronic signature services, likely with usage-based or subscription components.

Go-to-market motion1 record

Distribution channels5 records

Marketing channels7 records

Core offering

Cryptomathic provides enterprise cryptographic security software spanning centralized key management (CKMS, CrystalKey 360, CSG), mobile application protection (MASC), qualified digital signing (Signer, Managed Signing Services, National Signing Services), EMV payment card issuance and data preparation (Obsidian platform, CardInk), and certificate lifecycle management (TrustView, TrustView Lite). The portfolio is engineered for banks, fintechs, trust service providers, and government agencies that require FIPS 140-2 Level 3 HSM-backed cryptographic infrastructure and regulatory compliance with PCI DSS, eIDAS, OWASP, and ENISA. The company delivers its solutions via enterprise licensing, subscription services, professional implementation, and a global partner channel.

Product overview

Cryptomathic offers a comprehensive portfolio of cryptographic security solutions organized into distinct product families. The core platform is CrystalKey 360, an advanced key management product. Underlying key management is delivered through CKMS (Crypto Key Management System), enhanced by the Crypto Service Gateway (CSG) abstraction layer for unified HSM access. Mobile application security is provided by MASC (Mobile App Security Suite) comprising MASC Core and MASC Assurance modules. Digital identity and signing is enabled through Signer (remote digital signatures), Managed Signing Services, and National Signing Services. Payment infrastructure is supported by the Obsidian platform (Obsidian CA, Obsidian Issuance, Obsidian PIN, Obsidian Transact) plus CardInk for EMV data preparation. Certificate lifecycle management is handled by TrustView and TrustView Lite. All products are designed for regulated industries including banking, fintech, government, and trust service providers.

Differentiator

Problem solved

Functional benefit

Brands

• MASC (Mobile App Security Core): In-app protection suite for mobile banking, eID wallets and mobile apps managing sensitive data
• CrystalKey 360
• Signer
• Obsidian
• CardInk
• TrustView
• CKMS (Crypto Key Management System)
• CSG (Crypto Service Gateway)

Products and services

• CrystalKey 360 Advanced enterprise key management platform delivering compliance, crypto-agility, role-based access control, and cost optimization for organizations managing cryptographic keys across complex multi-cloud environments. Includes a developer portal for API access and integration.
• CKMS (Crypto Key Management System) Centralized cryptographic key management system that automates key lifecycle tasks (generation, storage, rotation, distribution, retirement), enforces security policies, integrates with applications, and provides audit-ready logging. Built on FIPS 140-2 Level 3 HSM infrastructure and supports multi-factor authentication, dual control, split knowledge, and PCI DSS Requirement 3 compliance.
• Crypto Service Gateway (CSG) Central cryptographic platform that standardizes access to heterogeneous HSMs (Utimaco, nCipher, SafeNet, Thales payShield, Atalla) behind a unified interface. Provides policy enforcement, centralized control, and supports PKCS#11, JCE, CSP, CNG, and RESTful APIs for application integration.
• MASC Core (Mobile App Security Core) In-app security SDK for iOS and Android that protects mobile banking apps, eID wallets, and applications managing sensitive data. Provides runtime application self-protection (RASP), app shielding, cryptographic toolbox, code hardening, secure storage, network protection, and API protection. Achieves 94% compliance with OWASP Mobile Application Security Verification Standard and ENISA Smartphone Guidelines, and includes 120+ posture and anomaly detections.
• MASC Assurance Remote in-app response module extending MASC Core with API protection and third-party system integration. Includes SOAR, TRA, and analytics integrations to relay detection results to backend fraud detection systems for enhanced threat response.
• Signer Remote digital signature solution suite enabling qualified trust service providers, governments, and financial institutions to create scalable qualified electronic signature or sealing services. Comprises three modules: Signature Creation Application (SCA), Signing Server Application (SSA), and Remote Qualified Signature/Seal Creation Device (rQSCD). Supports eIDAS compliance and includes a patent-pending evolutionary security design for MASC.
• Managed Signing Services Managed signing service for organizations requiring outsourced signing infrastructure. Provides a compliance-oriented platform for high-assurance environments where qualified electronic signatures are needed but in-house trust service operation is impractical.
• National Signing Services Reusable remote signing infrastructure for governments, trust service operators, and digital identity programs enabling qualified and advanced electronic signatures across public services at national scale.
• Obsidian CA EMV Certificate Authority solution for establishing a cryptographic root of trust for new payment schemes. Supports offline card authentication with certificate management and CRL handling for card issuance ecosystems.
• Obsidian Issuance Card issuance module that generates EMV chip data and cryptographic keys at scale for payment card personalization.
• Obsidian PIN PIN management solution handling PIN selection, mailer generation, and electronic PIN delivery with PCI PIN security compliance.
• Obsidian Transact Transaction processing module providing payment credential lifecycle management within the Obsidian platform.
• CardInk EMV data preparation solution that generates secure card data, manages cryptographic keys, and delivers personalization files to card bureaus. Supports EMV, Moneo, and magnetic stripe data preparation, proven at near 100,000 multi-application smart cards per day for Crédit Agricole (CEDICAM).
• TrustView Certificate lifecycle management solution providing comprehensive enterprise certificate governance, issuance, renewal, and monitoring.
• TrustView Lite Lightweight certificate lifecycle management solution offering simplified certificate governance for organizations with less complex PKI environments.

Quantifiable outcome

• Deployment timelines reduced from months to weeks for cryptographic applications
• +4 more outcomes

Named customers8 records

Segments7 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration6 records

AI capability1 record

Feature8 records

Partnerships

Ten partnerships are on record, tiered core and minor.

• PQ ShieldcoreChannel Partner/ Reseller/ DistributorPQ Shield operates as a value added reseller for Cryptomathic, distributing cryptographic security solutions to customers.
• LANACOminorChannel Partner/ Reseller/ DistributorChannel partner distributing Cryptomathic solutions.
• ScrivecoreImplementation/ SI/ Consulting PartnerSystem integrator and service provider partner that uses Cryptomathic Signer for digital signing services and qualified electronic signatures.
• INSTAminorChannel Partner/ Reseller/ DistributorChannel partner for Cryptomathic solutions.
• SDCminorChannel Partner/ Reseller/ DistributorChannel partner distributing Cryptomathic solutions.
• Infosec GlobalcoreStrategic or Co-development PartnerStrategic technology alliance partner for Cryptomathic, providing complementary cryptographic security capabilities.
• UtimacocoreTechnology or IntegrationHSM vendor integrated with Cryptomathic CSG, allowing customers flexibility in HSM vendor selection without lock-in.
• EntrustcoreTechnology or IntegrationTechnology alliance partner integrated with Cryptomathic solutions for comprehensive cryptographic security offerings.
• ThalescoreTechnology or IntegrationThales payShield HSMs integrated with Cryptomathic CSG, providing high-availability cryptographic operations.
• Amazon Web Services (AWS)coreTechnology or IntegrationAWS BYOK (Bring Your Own Key) service integration with Cryptomathic, enabling customers to use Cryptomathic key management with AWS cloud services.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• Thales (formerly Gemalto): Global digital security giant with payShield HSMs that Cryptomathic's CSG integrates with. Thales competes more broadly across data protection, payment security, and digital identity, with its own key management and signing offerings that overlap with Cryptomathic's portfolio.
• Entrust: Major PKI, HSM, and digital signature vendor integrated with Cryptomathic solutions. Entrust competes directly in certificate lifecycle management and qualified electronic signatures, with broader identity and payment security offerings that overlap with Cryptomathic's products.
• DocuSign (incl. DocuSign CLM): Dominant electronic signature and agreement platform with eIDAS-qualified signing capabilities. Competes with Cryptomathic's Signer solution for trust service providers and enterprises needing qualified electronic signatures at scale.
• AWS Key Management Service: Cloud hyperscaler native key management service that integrates with Cryptomathic via AWS BYOK. Represents both a partner (Cryptomathic manages customer keys used in AWS) and a competitor for cloud-native key management use cases.

Direct peers

• Utimaco: Leading independent HSM vendor whose hardware is integrated with Cryptomathic's CSG. Utimaco has expanded into higher-layer key management and crypto-agility offerings, positioning it as both a partner and a competitor to Cryptomathic's key management stack.
• Futurex: Specialist HSM and enterprise key management vendor serving banks, governments, and payment processors globally. Overlaps with Cryptomathic's HSM integration and key management capabilities for payment and enterprise cryptographic infrastructure.
• Venafi (CyberArk): Machine identity management company focused on certificate lifecycle and cryptographic key management at enterprise scale. Recently acquired by CyberArk, Venafi directly competes with Cryptomathic's TrustView and CKMS products in the certificate and key management space.
• Keyfactor: PKI-as-a-service and machine identity platform serving regulated enterprises and IoT manufacturers. Overlaps with Cryptomathic's TrustView certificate lifecycle management and broader PKI/key management capabilities for digital identity and IoT use cases.
• Securosys (incl. HSM and signing): Swiss HSM and digital transaction security provider serving banks, governments, and trust service providers. Competes with Cryptomathic in HSM-based key management, transaction signing, and qualified electronic signature infrastructure.

Emerging players

• HashiCorp: Cloud-era secrets and key management provider (Vault) widely adopted in DevOps and cloud environments. Represents an emerging competitive threat for less complex key management use cases that Cryptomathic's CKMS/CSG traditionally serve in regulated enterprises.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key highlights7 records

Customer concentration

• Xx.com/CRYPTOMAThIC
• YouTubeyoutube.com/@CryptomathicGlobal
• LinkedInlinkedin.com/company/cryptomathic

Compliance6 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Subsidiaries3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A1 record

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Cryptomathic