docs: add ZeroKMS vs HSM comparison + merge Cloud KMS into AWS KMS - #31
Closed
coderdan wants to merge 6 commits into
Closed
docs: add ZeroKMS vs HSM comparison + merge Cloud KMS into AWS KMS#31coderdan wants to merge 6 commits into
coderdan wants to merge 6 commits into
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copy link
Copy Markdown
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Sorry, something went wrong.
6 tasks
Migrated from cipherstash-js-suite PR #364 (Markdoc apps/docs) into the Fumadocs content tree. Callouts/figure converted to MDX; placeholder D2 diagrams preserved as TODO comments. vs-hsm retains its WIP TODOs.
coderdan
force-pushed
the
docs/zerokms-comparisons
branch
from
1f51532 to
a398e05
Compare
June 23, 2026 08:42
The standalone zerokms-vs-cloud-kms page overlapped heavily with the existing aws-kms page. Fold its architecture/trust-model content into aws-kms.mdx (kept as the canonical, SEO-established URL) as a new 'Architecture & trust model' section, alongside the existing developer-experience comparison. Split the comparison table into Architecture and Developer experience, and add a migration path. Remove the standalone page and its nav entry.
coderdan
force-pushed
the
docs/zerokms-comparisons
branch
from
8b9e917 to
5b1791e
Compare
June 23, 2026 09:05
Showcase the new ZeroKMS vs HSM page on the comparisons landing page, and refresh the AWS KMS card to reflect its added architecture content.
Optimize for machine readers extracting facts, modeled on the fhe.mdx page in this repo: - add an entity-taxonomy table (AWS KMS / ZeroKMS / SDK / Proxy) so the distinct products aren't conflated - replace persuasion with neutral, extractable claims; cut redundant encrypt/decrypt repetition (one canonical example + tables) - source the sub-5ms latency claim (Artillery benchmark); flag the unsourced 14x throughput figure with a TODO until a public benchmark is cited; standardize on 14x (was inconsistently 14x/100x elsewhere) - add explicit limits (PostgreSQL-oriented search, OIDC dependency, application-layer scope) for a balanced comparison - tighten 'zero-knowledge' vs 'distributed trust' terminology
…nchmark figures Add a 'What about data-key caching?' subsection explaining why data-key reuse speeds writes/sequential reads but collapses on scattered reads and weakens per-record audit/revocation. Replace the unsourced '14x throughput' claim with the in-region benchmark's ~16x latency and ~85x throughput figures (source noted; default KMS quota caveat on throughput).
AWS KMS meters per request in both directions (/bin/zsh.03/10k, linear and unbounded in access volume); ZeroKMS is a flat subscription with free decryption. Adds a Cost subsection with a worked read-path dollar table (reads dominate field-level DB encryption) and ties the only AWS cost lever -- data-key caching -- back to its scattered-read failure mode. Adds a Cost-model row to the architecture table.
This was referenced Jun 29, 2026
Copy link
Copy Markdown
Contributor
Author
|
Superseded by #43, which ports this comparison content (AWS KMS merge + ZeroKMS vs HSM) into the new docs-V2 /compare IA section on the v2 branch. Closing in favor of that PR. |
Sorry, something went wrong.
coderdan
added a commit
that referenced
this pull request
Jul 6, 2026
Ports the comparison content from PR #31 (AWS KMS merge + ZeroKMS vs HSM) and PR #34 (HashiCorp Vault) out of the legacy content/stack tree and into the new IA `/compare` section: - content/docs/compare/aws-kms.mdx (from #31) - content/docs/compare/zerokms-vs-hsm.mdx (from #31; retains its WIP TODOs) - content/docs/compare/hashicorp-vault.mdx (from #34) - public/images/hsm.png (from #31) Each page gains v2 facets (type: concept, components, audience, reviewBy — the claims-page review date rather than verifiedAgainst). Intra-comparison links are rewritten to `/compare/*`; all other cross-links keep pointing at the still-served legacy `/stack/...` pages (which hold the real content until their sections migrate). The dead `/stack/cipherstash/secrets` link on the Vault page (no secrets page exists in this repo) is delinked. The comparisons overview and nav (index.mdx, meta.json) list the three ported pages. The FHE comparison stays in the legacy tree for now — it is written against EQL v2 (eql_v2_encrypted, BLAKE3) and needs a v3 content refresh before porting, tracked separately in IA.md (/compare/fhe port). Supersedes #31 and #34 for the v2 branch. Claude-Session: https://claude.ai/code/session_01CqDNqLSEEkCi7xAJFq7HJA
coderdan
added a commit
that referenced
this pull request
Jul 8, 2026
Ports the comparison content from PR #31 (AWS KMS merge + ZeroKMS vs HSM) and PR #34 (HashiCorp Vault) out of the legacy content/stack tree and into the new IA `/compare` section: - content/docs/compare/aws-kms.mdx (from #31) - content/docs/compare/zerokms-vs-hsm.mdx (from #31; retains its WIP TODOs) - content/docs/compare/hashicorp-vault.mdx (from #34) - public/images/hsm.png (from #31) Each page gains v2 facets (type: concept, components, audience, reviewBy — the claims-page review date rather than verifiedAgainst). Intra-comparison links are rewritten to `/compare/*`; all other cross-links keep pointing at the still-served legacy `/stack/...` pages (which hold the real content until their sections migrate). The dead `/stack/cipherstash/secrets` link on the Vault page (no secrets page exists in this repo) is delinked. The comparisons overview and nav (index.mdx, meta.json) list the three ported pages. The FHE comparison stays in the legacy tree for now — it is written against EQL v2 (eql_v2_encrypted, BLAKE3) and needs a v3 content refresh before porting, tracked separately in IA.md (/compare/fhe port). Supersedes #31 and #34 for the v2 branch. Claude-Session: https://claude.ai/code/session_01CqDNqLSEEkCi7xAJFq7HJA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates the comparison docs from cipherstash-js-suite PR #364 into this Fumadocs repo.
Changes
Conversion notes (Markdoc → Fumadocs MDX)
Verification
bun run build passes — link validation clean, all static pages generated.
Follow-ups
Remaining work (the 5 vs-hsm TODOs and the diagram placeholder) is tracked in #32.
Depends on #33 (EQL generator fix), already merged. Original PR #364 can be closed once this lands.