A method of managing the provisioning of security modules, each security module being formed by a chip with at least one subscription profile installed thereon, the method comprising: providing a plurality of chips, each chip having a unique chip identifier for that chip and having stored thereon a group key that is common to the plurality of chips; receiving a plurality of data files, each data file encrypted with the group key and having a unique data file identifier for that data file and providing data for an associated subscription profile including a service credential for the associated subscription profile; and for each data file in the plurality of data files: performing a load operation to load that data file onto a selected chip, during which the encrypted version of that data file is decrypted using the group key stored on the selected chip; on successful performance of the load operation, employing security module operating software loaded on the selected chip to generate a proof of loading (PoL) file that is cryptographically authenticated using a PoL signing key, the PoL file identifying the unique data file identifier for the loaded data file and the unique chip identifier of the chip onto which the loaded data file has been loaded; processing the PoL file using token generation software for generating a token for the selected chip, the token generation software being executed in a secure execution environment and restricting generation of the token to ensure that, for a given data file, if two or more chips are successfully loaded with that given data file, the token is generated for only one of the two or more chips; in response to successful generation of the token for the selected chip, loading the token onto the selected chip; and in response to a determination that the token loaded onto the selected chip passes a token validity check, controlling, with the security module operating software loaded on the selected chip, activation of the selected chip for service access. providing a plurality of chips, each chip having a unique chip identifier for that chip and having stored thereon a group key that is common to the plurality of chips; receiving a plurality of data files, each data file encrypted with the group key and having a unique data file identifier for that data file and providing data for an associated subscription profile including a service credential for the associated subscription profile; and for each data file in the plurality of data files: performing a load operation to load that data file onto a selected chip, during which the encrypted version of that data file is decrypted using the group key stored on the selected chip; on successful performance of the load operation, employing security module operating software loaded on the selected chip to generate a proof of loading (PoL) file that is cryptographically authenticated using a PoL signing key, the PoL file identifying the unique data file identifier for the loaded data file and the unique chip identifier of the chip onto which the loaded data file has been loaded; processing the PoL file using token generation software for generating a token for the selected chip, the token generation software being executed in a secure execution environment and restricting generation of the token to ensure that, for a given data file, if two or more chips are successfully loaded with that given data file, the token is generated for only one of the two or more chips; in response to successful generation of the token for the selected chip, loading the token onto the selected chip; and in response to a determination that the token loaded onto the selected chip passes a token validity check, controlling, with the security module operating software loaded on the selected chip, activation of the selected chip for service access. performing a load operation to load that data file onto a selected chip, during which the encrypted version of that data file is decrypted using the group key stored on the selected chip; on successful performance of the load operation, employing security module operating software loaded on the selected chip to generate a proof of loading (PoL) file that is cryptographically authenticated using a PoL signing key, the PoL file identifying the unique data file identifier for the loaded data file and the unique chip identifier of the chip onto which the loaded data file has been loaded; processing the PoL file using token generation software for generating a token for the selected chip, the token generation software being executed in a secure execution environment and restricting generation of the token to ensure that, for a given data file, if two or more chips are successfully loaded with that given data file, the token is generated for only one of the two or more chips; in response to successful generation of the token for the selected chip, loading the token onto the selected chip; and in response to a determination that the token loaded onto the selected chip passes a token validity check, controlling, with the security module operating software loaded on the selected chip, activation of the selected chip for service access.