The AATL Technical Requirements specify that the certificate authority must generate and protect key pair(s) for the supplied certificate(s) in a medium that does not permit exportation and duplication allowing unauthorized use of the private or secret keys. The most appropriate medium is considered to be a hardware security module that meets FIPS 140-2 Level 3 or an equivalent such as the SafeNet I Key. One hardware token is included in the sales price and will be sent by GlobalSign to the certificate owner after the order has been placed successfully.