Currently for payouts I'm using a traditional tz1 addr, which is managed by the default tezos-signer binary. However, it appears to me not that safe. Some kind of HSM + KMS (say, from Google or from Amazon) seems to be a better solution. But this path requires using tz2 and tz3 addresses, which in practice might cause some problems. So, maybe, someone came up with working and well-tested setups apart from one that is described in the trd docs.

1 Answer 1


Using an HSM from a cloud provider comes at significant cost. AWS CloudHSM for example is just above $USD1,000/month. The other downside here is vendor lock-in. You cannot import an existing key into cloud providers, and if you want to leave/switch, you cannot export it. You have to transfer/change addresses. If this is your payouts address, that's probably not a big deal.

TRD can run anywhere. You can use a ledger at home, and run TRD on your home computer with tezos-signer utilizing the ledger. Downside, you must click the ledger to make payouts (ie: no automated payments, which is what TRD is best at)

Security always comes at a cost of convenience.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.