Typically the HSM will be part of a tokenization service that is located in a separate security zone also called a data bunker or data vault. The customer faci

Typically the HSM will be part of a tokenization service that is located in a separate security zone also called a data bunker or data vault. The customer facing application will pass in the sensitive data and in its place a token will be returned. When the calling application needs the data it will pass in the token and the data is returned. An attacker that compromised the customer facing application only has access to tokens and would be forced to access sensitive data via the data bunker. That application is heavily monitored and would hopefully be quickly noticed. The HSM adds an additional layer of protection against loss of sensitive data via backup tapes or some insider attacks.