A city’s permitting platform must store encryption keys for citizen document uploads. Compliance requires an isolated HSM partition, a large included key-version allotment, and vault backup. Which OCI Vault type should the developer choose?

A virtual private vault is the Vault type that gives the permitting platform an isolated HSM partition, a large included key-version allotment, and vault backup—the three compliance requirements stated for citizen document encryption keys. Default vaults share HSM capacity across tenants of that vault class and meter key versions differently; they do not deliver the isolated partition-plus-backup package that virtual private vaults are designed for. Choosing the vault type at create time therefore matters for both security isolation and operational continuity of key material for municipal uploads.

Treating a default vault as convertible later fails because vault type cannot be changed after creation; you cannot start shared and later promote into a private HSM partition. Pairing a default vault with External KMS or HYOK because backup was mentioned confuses hold-your-own-key integrations with the backup capability that virtual private vaults already include—HYOK is not a prerequisite whenever backup appears in a requirements list. Claiming virtual private vaults cannot hold master encryption keys is simply false; those vaults are purpose-built to host master keys under stronger isolation.

Exam caveat: virtual private vaults cost more and still cannot be converted to or from default later, so size the need for isolation and backup before create rather than defaulting to the cheaper shared type and hoping to upgrade. Operational check: after create, confirm in the Vault console that the vault shows as virtual private, that backup is available for the municipal key set, and that the included key-version allotment covers expected rotation volume for citizen document keys before relying on the vault in production.