--- title: "2 of 18 encryption tools protect a file after it leaves; disk encryption is free" summary: "What 18 encryption, key and rights-management products, two cloud key price lists and NIST's post-quantum draft showed an Indian buyer, as of September 2026." url: https://www.thetechbag.com/blog/comprehensive-data-encryption format: Analysis desk: "Data & privacy" published: 2026-03-24 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["encryption","BitLocker","key management","HSM","rights management","Seclore","post-quantum","NIST","DPDP"] cover: https://www.thetechbag.com/blog/covers/comprehensive-data-encryption.png --- # 2 of 18 encryption tools protect a file after it leaves; disk encryption is free *What 18 encryption, key and rights-management products, two cloud key price lists and NIST's post-quantum draft showed an Indian buyer, as of September 2026.* Analysis · Data & privacy · By TechBag · Published 2026-03-24 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/comprehensive-data-encryption The short version - Encrypting the disk and the cloud bucket costs nothing extra: BitLocker ships with Windows Pro, FileVault with macOS, file-based encryption on every Android phone launched since Android 10, and Amazon S3 has encrypted every new object by default since January 2023. The work left is the recovery key.[2] [5] - Of the 18 products in TechBag’s encryption and rights-management guide, 11 encrypt storage or hold keys, 5 only label files, and 2 keep protecting a file after it has been sent. Only 2 of the 18 print a price.[1] - A key in a cloud HSM lists at US$1 to US$3 a month. The date worth planning against is in NIST’s draft transition plan: RSA and elliptic-curve keys at 112-bit strength deprecated after 2030, and all of them disallowed after 2035.[6] [7] [8] The 2024 version of this piece explained the difference between symmetric and asymmetric encryption and walked through switching on BitLocker. Both are settled questions; nobody in an Indian IT team is choosing between AES and RSA. What they are choosing is narrower and more expensive: which encryption they already own, which of the products on the market they actually need, what keeping the keys costs, and which deadline should shape a purchase made this year. We took TechBag’s own guide, three public price lists and NIST’s transition plan and counted. ## The disk is solved; the recovery key is not BitLocker is licensed with Windows Pro, Enterprise and Education. On qualifying hardware, Windows turns on “device encryption” by itself after setup, using XTS-AES with a 128-bit key, and backs the recovery key up to Entra ID, Active Directory or the user’s Microsoft account.[2] Android has not allowed full-disk encryption on new devices since Android 10 and requires file-based encryption instead.[3] Apple builds Data Protection into iPhone, iPad and Mac.[4] On the server side, Amazon S3 has applied server-side encryption to every new object at no additional cost since 5 January 2023.[5] **Figure: Encryption at rest is already in what you pay for; key custody and files that leave are not** *What ships switched on or licensed, against what needs a decision or a purchase, as documented by the vendors in 2023 to 2026* Already paid for - BitLocker on Windows Pro, Enterprise and Education; automatic device encryption on qualifying PCs - FileVault on Mac; Data Protection on iPhone and iPad - File-based encryption, the only kind Android allows on phones launched with Android 10 or later - Server-side encryption on every new Amazon S3 object since January 2023 Needs a decision or a purchase - Escrow and reporting of every recovery key, centrally - Who holds the master keys, and in which country - Secrets: API keys and database passwords outside the code - Protection for a file once it has been emailed out Source: Microsoft BitLocker overview; Android Open Source Project; Apple Platform Security; AWS S3 announcement; TechBag encryption guide · as of 30 September 2026 The catch is in Microsoft’s own documentation. A Windows PC that uses only local accounts “remains unprotected even though the data is encrypted”, because no recovery key was ever escrowed and the protector is never sealed.[2] That is the realistic state of a small office’s laptops: encrypted on paper, with no one able to say where the keys are. NIST, for its part, does not expect symmetric algorithms such as AES to need replacing in the post-quantum transition.[7] The disk is the solved part. Our view Our view: before buying any encryption product, run one report from your device-management console: which devices are encrypted, and for which of them a recovery key is held centrally. If the second number is lower than the first, that gap is the project. ## What the 18 products in our guide actually do TechBag’s Encryption & Rights Management guide lists 18 products from nine vendors: Thales, Entrust, HashiCorp, ESET, Trellix, Seqrite, Seclore, Microsoft and Forcepoint.[1] Sorted by what each one does rather than what its datasheet is called, they split three ways. **Figure: 11 of 18 products encrypt storage or hold keys; only 2 protect a file after it leaves** *Products in TechBag's encryption and rights-management guide by what the control does, count, as of September 2026* - Rights management, travels with the file: Seclore ARMOR EDRM, Microsoft Purview2 products 11% - Classification, labels only: decides what gets protected, enforces nothing5 products 28% - Encryption and key custody: disk, database, HSMs, PKI, secrets11 products 61% | | Value (products) | Share | | --- | --- | --- | | Rights management, travels with the file: Seclore ARMOR EDRM, Microsoft Purview | 2 | 11% | | Classification, labels only: decides what gets protected, enforces nothing | 5 | 28% | | Encryption and key custody: disk, database, HSMs, PKI, secrets | 11 | 61% | Source: TechBag Encryption & Rights Management guide, capability tags verified against vendor documentation · as of 30 September 2026 TechBag countHow TechBag counted Each product carries a tag for what the control is, verified against vendor documentation on 24 August 2026, and we counted the tags in the guide as it stood on 30 September 2026. Keys: 14 of the 18 hold keys only with the customer; 4 let either side hold them. India: 4 are India-built (two Seqrite, two Seclore), 10 document a data region you must confirm, and 4 do not document one. Price: 16 quote; the 2 that print a figure are ESET PROTECT Advanced at about US$55 a device a year, with full-disk encryption inside the endpoint suite, and Microsoft Purview at US$12 a user a month as the E5 Compliance add-on.[1] The classification tools are where money is most often wasted. A label on a document is metadata; it does something only when a DLP engine or a rights-management server reads it. Bought alone, it produces a tidy taxonomy that nothing enforces. Rights management is the opposite case: the only control on the list that still works after a file has gone to an auditor, a distributor or a design partner, because the policy sits inside the file and the recipient’s copy can be revoked. If files do not leave your organisation, you do not need it. If they do, nothing else in the 18 answers the question. The most under-bought line in the “encryption and key custody” group is secrets management: somewhere other than the code to keep API keys, database passwords and certificates, with rotation and an audit trail. It is also the cheapest place to start. HashiCorp Vault’s Community edition is free and self-hostable, with the managed and Enterprise editions quoted; Thales sells the same job as CipherTrust Secrets Management, licensed by the applications that call it rather than by data volume.[1] An encrypted database whose password sits in a configuration file in the repository is encrypted in name only. ## Keys cost a dollar a month in the cloud and a capital budget on premises The cloud providers publish the price of key custody, and it is small. AWS KMS charges US$1 a month for each customer-managed key, plus US$1 a month for each of the first two rotations, after which rotation is free.[6] Google Cloud KMS bills by the hour; at 730 hours a month a software key costs about six cents and a key held in Google’s HSMs US$1 to US$2.50, plus US$0.03 per 10,000 operations, the same rate AWS uses in its own worked example.[8] **Figure: A key held in a cloud HSM lists at US$1 to US$3 a month** *List price to keep one key for one month, US$, AWS KMS and Google Cloud KMS (Google prices effective 17 March 2025)* Google Cloud external key manager key key held outside Google US$3 Google Cloud HSM key, RSA 3072+ or elliptic curve first 2,000 a month US$2.5 AWS KMS customer-managed key plus US$1 for each of the first two rotations US$1 Google Cloud HSM key, AES-256 or RSA 2048 US$1 Google Cloud software key US$0.06 | | Value (US$) | | --- | --- | | Google Cloud external key manager key | 3 | | Google Cloud HSM key, RSA 3072+ or elliptic curve | 2.5 | | AWS KMS customer-managed key | 1 | | Google Cloud HSM key, AES-256 or RSA 2048 | 1 | | Google Cloud software key | 0.06 | Source: AWS KMS pricing page; Google Cloud KMS pricing page (hourly rates × 730 hours, TechBag arithmetic) · as of 30 September 2026 · Operations are billed on top, at US$0.03 per 10,000 requests in both providers’ examples A dedicated HSM is a different order of cost. AWS’s own worked example prices a CloudHSM at US$1.60 an hour, which is about US$1,168 a month for one unit, and a production deployment wants two.[6] On premises, the two hardware HSMs on TechBag’s guide, Thales Luna and Entrust nShield, are quote-only capital purchases: an appliance plus a support contract, and a second unit if you want to survive the first failing.[1] Our view Our view: the price of a key is a rounding error; what you are buying is custody. A cloud key is the right answer for most Indian companies already on that cloud. A hardware HSM earns its cost where a regulator, a payment scheme or a customer contract says the key must sit in a box you control, and almost nowhere else. ## The deadline is 2030, and it is about RSA, not AES NIST published its first three post-quantum standards on 13 August 2024: ML-KEM for establishing keys and ML-DSA and SLH-DSA for signatures, and urged administrators to start integrating them immediately.[9] Its transition plan, still in draft as of September 2026, sets the dates for retiring what they replace.[7] Laid out on a calendar, the shape is plain: both 2024 milestones are publications, and the first date that changes what an RSA key may be used for is after 2030. **Figure: RSA and elliptic-curve keys have a proposed retirement date; AES does not** *NIST post-quantum standards and the proposed transition for quantum-vulnerable algorithms, 2024 to 2035* | Date | Event | Detail | | --- | --- | --- | | 2024 | 13 Aug: standards published | FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). NIST: start integrating now. | | 2024 | 12 Nov: transition draft | NIST IR 8547 proposes the schedule that follows for RSA, ECDSA, EdDSA and the key-establishment schemes built on them. | | 2030 | After 2030: deprecated | Quantum-vulnerable algorithms at 112 bits of security strength, which includes 2048-bit RSA, may be used only after the data owner accepts the risk. | | 2035 | After 2035: disallowed | All quantum-vulnerable public-key algorithms, at every strength. The year matches the 2035 goal in the US National Security Memorandum 10. | Source: NIST, FIPS 203, 204 and 205 release; NIST IR 8547 initial public draft · as of 30 September 2026 · The 2030 and 2035 dates are NIST's draft proposal for US federal use, not an Indian rule Two things in the draft matter to a buyer in India. First, the risk is not evenly spread: NIST names “harvest now, decrypt later” as the threat to key establishment in TLS and to encrypted email, because traffic captured today can be read once a large enough quantum computer exists.[7] Data that must stay confidential for ten years, such as health records, Aadhaar-linked files or a design drawing, is the data to move first. Second, the draft says HSMs and TPMs will need firmware or hardware revised to support the new algorithms.[7] An HSM bought this year should come with a written answer on ML-KEM and ML-DSA support. If you are buying this in India The **DPDP Rules, 2025** (G.S.R. 846(E), 13 November 2025) name encryption in the first line of the security-safeguards rule: Rule 6(1)(a) lists “encryption, obfuscation, masking or the use of virtual tokens”, and Rule 6(1)(d) asks for continued processing “such as by way of data-backups” if data is compromised.[10] Those duties come into force on 13 May 2027.[11] The Act’s schedule sets a penalty of up to ₹250 crore for failing to take reasonable security safeguards.[12] CERT-In’s Directions of 28 April 2022 already require incidents to be reported within six hours; being able to show from a console that a lost laptop was encrypted and its key escrowed is the difference between a short report and a long one.[13] On price, the two India-built vendors in the guide, Seclore and Seqrite, quote in rupees. Everything else here, ESET, Purview, AWS and Google Cloud included, is a USD list price: bought through a reseller it arrives as an INR invoice with 18% GST. For residency, ask each vendor which region holds the policy server and the key material, not just the data; 4 of the 18 products in our guide do not document it.[1] How we did this Figures as of 30 September 2026 Product counts come from TechBag’s Encryption & Rights Management guide as it stood on 30 September 2026, whose capability, key-custody, India and price tags were verified against vendor documentation on 24 August 2026; each product was counted once, by its primary control. Cloud key prices are list prices from the AWS KMS and Google Cloud KMS pricing pages; Google’s hourly rates were multiplied by 730 hours. Azure Key Vault was left out because its public price page did not show figures when read. The built-in encryption facts are from the vendors’ own documentation. The NIST dates are from the November 2024 initial public draft of IR 8547, a proposal for US federal systems, not an Indian obligation. Exchange rates, reseller margins and HSM appliance prices, which are quote-only, are excluded. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Encryption & Rights Management guide (18 products, 9 vendors; tags, India and price fields)](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) — verified 24 August 2026; version of 30 September 2026 2. [Microsoft Learn, BitLocker overview (editions, device encryption, XTS-AES 128, local accounts)](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/) — page dated 24 August 2026 3. [Android Open Source Project, Encryption (full-disk encryption not allowed on new Android 10+ devices)](https://source.android.com/docs/security/features/encryption) — undated page 4. [Apple Platform Security, Data Protection overview](https://support.apple.com/guide/security/data-protection-overview-secf6276da8a/web) — published 3 August 2026 5. [AWS, Amazon S3 now automatically encrypts all new objects](https://aws.amazon.com/about-aws/whats-new/2023/01/amazon-s3-automatically-encrypts-new-objects/) — 5 January 2023 6. [AWS Key Management Service pricing (US$1 a key a month; rotation; CloudHSM example at US$1.60 an hour)](https://aws.amazon.com/kms/pricing/) — undated page 7. [NIST IR 8547 (initial public draft), Transition to Post-Quantum Cryptography Standards](https://csrc.nist.gov/pubs/ir/8547/ipd) — 12 November 2024 8. [Google Cloud, Cloud Key Management Service pricing](https://cloud.google.com/kms/pricing) — prices effective 17 March 2025 9. [NIST, NIST Releases First 3 Finalized Post-Quantum Encryption Standards](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards) — 13 August 2024 10. [MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Rule 6](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025 11. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 12. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 13. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 Related on TechBag: the [Seclore ARMOR EDRM page](https://www.thetechbag.com/seclore/seclore-edrm) for protection that travels with the file, and the [Thales Luna HSM page](https://www.thetechbag.com/thales/thales-luna-hsm) for keys held in hardware you own. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Encryption & rights management guide](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) — the 18 products, by what travels with the file and who holds the keys - [Seclore ARMOR EDRM](https://www.thetechbag.com/seclore/seclore-edrm) — India-built rights management that travels with the file - [Thales Luna HSM](https://www.thetechbag.com/thales/thales-luna-hsm) — keys held in hardware you own