# Every other control protects data while it is inside your boundary. This is the only one that still works after the file has left. *Encryption & Rights Management — a TechBag decision guide. Last reviewed 2026-10-03.* > Rights management puts the policy inside the document rather than around it. The file carries its own rules — who may open it, whether they may print or copy, when it expires — and those rules are enforced on a recipient’s laptop in an organisation you do not control. **The checkable fact:** The test that separates this from everything else on the site: a confidential file was legitimately sent to an external auditor last month and the engagement has ended. Can you stop them opening it today? Only one product on this page can. - Canonical: https://www.thetechbag.com/browse/data-security-privacy/encryption-rights - Category: [Data Security & Privacy](https://www.thetechbag.com/browse/data-security-privacy) - Products compared: 22 ## What encryption & rights management actually is Six products, three distinct jobs. **Rights management** wraps policy inside the file so it stays enforced anywhere. **Encryption** protects storage — a disk, a removable drive, a database — so a stolen device or a raw dump is unreadable. **Classification** labels documents so one of the other two knows what to act on. They are routinely conflated, and the cost of conflating them is specific: buyers who ask for encryption usually already have it from their storage layer or device management, and buyers who need protection to survive the file leaving find that disk encryption does nothing at all for that scenario. **The most common mis-purchase.** What the **external recipient** has to do. If opening a protected file requires them to install your software, register an account or contact your helpdesk, the process is abandoned within weeks and people revert to unprotected email. This decides adoption more than any capability on the datasheet, and it is the question to put in writing before signature. ## Four terms, resolved These are adjacent controls at different points in the data’s life, not tiers. A product that encrypts a disk perfectly protects nothing once a legitimate user copies a file off it. ### Encryption at rest vs in transit Which gap are you actually closing? ### Encryption at rest vs in use Is the data protected while it is being processed? ### EDRM/IRM vs encryption Does the protection travel, or stop at your boundary? ### EDRM/IRM vs DLP Stop the file, or protect it after it goes? The practical consequence: confirm which of the three jobs you are buying before you compare products, because all six vendors here will use the word encryption and only one of them makes protection survive the file leaving. ## The decision variables Six variables move the shortlist. Everything else is preference. **What travels with the file.** Whether the policy is inside the document or around its container. This is the dividing line of the whole page. **Revocation after distribution.** Withdrawing access to a file already delivered is the reason to buy rights management. Confirm in writing whether it reaches a copy already downloaded and held offline. **The external-recipient experience.** Can they open it with no software from you? This decides adoption, and adoption decides whether the investment returns anything. **Format and application coverage.** Office and PDF are universal here. CAD, engineering drawings and arbitrary formats are not — and manufacturing estates usually need them. **Integration with DLP and DSPM.** Rights management is normally the enforcement arm of a classification decision made elsewhere. Applied manually, it is applied rarely. **Key management.** Who holds the keys, where they are held, and what happens to protected files if the vendor relationship ends. Nobody owns this until it matters. ## The 22 products Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one. ### Thales CipherTrust Secrets Management — Thales - **Who it's for:** Estates where the real exposure is not encrypted-at-rest data but the long-lived credential sitting in a repository. Leaked credentials in source control are one of the most reliably exploited initial-access routes there is, and the credential is usually shared widely and rotated never. This replaces that with centrally issued, scoped, rotatable secrets — and it roots into the same CipherTrust key custody as the rest of the platform. - **The honest limitation:** This is infrastructure credential hygiene, NOT document protection — it will not follow a file anywhere, and if that is your problem you want EDRM. It also competes directly with HashiCorp Vault, which has a free self-hostable edition and a far larger engineering community; the case for buying it from Thales is that you already run CipherTrust and want one key-custody story rather than two. - **Price:** Quote — Quote-only, licensed by the applications and workloads that authenticate to it rather than by data volume; centralises API keys, database passwords, certificates and tokens so they stop living in config files, environment variables and CI/CD settings - **Details:** https://www.thetechbag.com/thales/thales-ciphertrust-secrets-management ### HashiCorp Vault — HashiCorp (IBM) - **Who it's for:** Engineering-led estates that need encryption-as-a-service and key custody under their own control rather than a document-protection product. Vault issues and rotates keys, encrypts data on behalf of applications without ever handing them the key material, and can run entirely on your own infrastructure in India — which is the cleanest answer to a DPDP or RBI question about who holds the keys. - **The honest limitation:** This is NOT rights management and will not protect a document that leaves your estate — different problem, different product. It is also operationally heavy: Vault is a distributed system with unseal, replication and upgrade responsibilities, and teams underestimate that consistently. HashiCorp is now an IBM company, so weigh roadmap direction accordingly. - **Price:** Free → Quote — Community edition is free and self-hostable; HCP Vault is managed and quoted, Enterprise is quoted per cluster. Metering is on clients rather than data volume — an application or workload that authenticates to Vault - **Details:** https://www.thetechbag.com/hashicorp/hashicorp-vault ### ESET PROTECT Advanced — ESET - **Who it's for:** Organisations whose actual encryption requirement is the laptop that gets left in a taxi, not inter-company document control. Full-disk encryption is what turns a lost device from a reportable breach into an inventory problem under DPDP — and buying it inside the endpoint suite you were purchasing anyway is materially cheaper than a standalone encryption product. - **The honest limitation:** Full-disk encryption protects data AT REST ON THE DEVICE and nothing else. The moment a file is copied off, emailed or uploaded it is plaintext again — there is no travelling policy, no post-distribution revocation, and no control over the recipient. If your problem is documents leaving the organisation, this is the wrong category entirely; look at EDRM. - **Price:** ~$55 (≈ ₹4,565) — per device per year on PUBLIC list pricing — the only published price in this guide. Full-disk encryption is bundled into the endpoint-protection tier rather than sold as a separate SKU, alongside cloud sandboxing - **Details:** https://www.thetechbag.com/eset/eset-protect-advanced ### Thales CipherTrust Data Discovery and Classification — Thales - **Who it's for:** The estate that has bought encryption and cannot confidently say what it is pointed at. Every other control on this page — encryption, access policy, key management — has to be aimed at something, and aiming it at an asset inventory nobody trusts is how encryption programmes quietly miss the data that mattered. Under the DPDP Act the first practical question is what personal data you hold and where, which is this product’s output rather than a by-product. - **The honest limitation:** Classification is not protection — it labels and hands off, and bought alone it produces an inventory nothing acts on. It is also the least glamorous line in a proposal and the first one cut, which is usually the decision that undermines everything bought alongside it. - **Price:** Quote — Quote-only, scoped by the data stores scanned; scans structured and unstructured stores to find sensitive data and label what it finds, feeding the rest of the CipherTrust platform - **Details:** https://www.thetechbag.com/thales/thales-data-discovery-classification ### Seqrite Data Privacy — Seqrite - **Who it's for:** Indian organisations working out what the DPDP Act actually requires of them. Before you can protect personal data you have to find it and know what it is, and this is the discovery-and-classification half of that problem from a vendor headquartered in Pune with Indian support and INR invoicing. - **The honest limitation:** Classification is not protection. It tells you where personal data lives and labels it — it does not encrypt the file, does not travel with it, and cannot revoke access after distribution. It is the input to a protection decision, so pair it with EDRM or DLP or the labels achieve nothing on their own. - **Price:** Quote (INR) — Quoted in INR by an India-built vendor (Quick Heal), SaaS or on-premises; scoped around discovering and classifying personal data rather than encrypting documents - **Details:** https://www.thetechbag.com/seqrite/seqrite-data-privacy ### Thales CipherTrust Manager — Thales - **Who it's for:** The buyer whose regulator has stopped asking whether data is encrypted and started asking who can decrypt it. Cloud providers encrypt at rest by default and it protects against exactly one thing, a stolen disk — it does nothing about the provider, who holds the key. CipherTrust Manager makes the keys yours, under your policy, on infrastructure you operate, so the answer to an auditor is a demonstration rather than a contract clause. - **The honest limitation:** This protects infrastructure, not documents — it will not follow a file that leaves your estate, and if that is your problem you want EDRM instead. CipherTrust as-a-Service is EU/NA only with NO India region, so residency-bound buyers deploy on-premises. And be precise about a fact this market blurs: Thales has 2,200+ staff in India with Noida as its Cyber & Digital centre, but people in India and data in India are different things. - **Price:** Quote — Quote-only. Deploys as a virtual appliance or physical hardware, and can be rooted in a Luna HSM so master keys never exist in software. Licensed by scope — the hosts, databases or applications protected — rather than by data volume - **Details:** https://www.thetechbag.com/thales/thales-ciphertrust-manager ### Thales Luna HSM — Thales - **Who it's for:** Indian BFSI, government and defence-adjacent buyers whose regulator asks specifically about hardware key protection, and payments or PKI use cases with an explicit HSM mandate. Keys are generated inside tamper-resistant hardware and never leave in usable form, so compromising the server that calls the HSM does not yield the key. It is also the strongest possible answer to an Indian residency question — the key is in a physical box in your data centre. - **The honest limitation:** This is an appliance, not software, and budgets go wrong in a predictable way: the purchase price gets captured and firmware maintenance, security-domain backup, separation of duties between administrators and approvers, and a second unit for resilience do not. For Indian tenders, Thales lists BIS registration (IS 13252) for the Luna Network HSM — confirm the certificate covers the exact model you are buying. - **Price:** Quote — Quote-only, and it is a capital purchase rather than a subscription — an appliance price plus a support contract, and more than one unit if you want to survive a site failure - **Details:** https://www.thetechbag.com/thales/thales-luna-hsm ### Thales CipherTrust Transparent Encryption — Thales - **Who it's for:** Estates whose most sensitive systems are the ones nobody will modify. Encryption programmes stall because protecting data appears to require changing every application that touches it, and a fifteen-year-old line-of-business system is not getting refactored whatever the policy says. An agent leaves it untouched. The second capability matters as much: privileged-user access control lets a DBA administer a system without reading the data inside it — exactly the control an RBI or SEBI reviewer probes. - **The honest limitation:** There is a performance overhead, and the only number that means anything is the one you measure on your own least-modern system rather than a clean test host. It also protects data at rest on infrastructure you control and nothing beyond that — a file exported by an authorised process is plaintext the moment it lands elsewhere. - **Price:** Quote — Quote-only, typically licensed per protected host. An agent sits between the application and storage, so no application changes are required - **Details:** https://www.thetechbag.com/thales/thales-ciphertrust-transparent-encryption ### Entrust nShield HSM — Entrust - **Who it's for:** Indian BFSI and government buyers who need hardware key custody and want Security World, which manages keys across a group of HSMs as one logical unit so resilience and disaster recovery are designed in. It fits best where Entrust PKI or identity products are also in the plan. BIS registration (IS 13252) is a mandatory safety gate that nShield Connect XC and Thales Luna both clear — ask for the certificate for the exact model, since the nShield 5c is unconfirmed. - **The honest limitation:** An appliance, not software: budget firmware maintenance, Security World backup, separation-of-duties roles that did not previously exist, and a second unit for resilience. nShield as a Service has NO India region (UK/US/DE/AU), so India means on-premises. And on analyst standing we are being conservative — Gartner publishes no MQ for HSM or key management at all, and we could not verify an HSM Leader placement for Entrust with any analyst. Thales has the stronger verified position. - **Price:** Quote — Quote-only, and a capital purchase rather than a subscription — appliance price plus support, and more than one unit if you want to survive a site failure. Security World manages keys across a group of HSMs as one logical unit - **Details:** https://www.thetechbag.com/entrust/entrust-nshield-hsm ### Entrust PKI — Entrust - **Who it's for:** Estates where machine identities are multiplying faster than anyone can issue certificates by hand. Private certificate authority for the machine identities, device certificates, internal TLS and code signing your own systems trust — with the trust model, issuance policy and validity periods defined by you rather than inherited from a commercial CA’s compliance record. - **The honest limitation:** READ THE SCOPE: this is PRIVATE PKI. Entrust sold its entire public TLS certificate business to Sectigo in September 2025 after Chrome, Apple and Mozilla distrusted its roots — so publicly trusted SSL for an internet-facing site is no longer an Entrust product, whatever older search results say. Private PKI was not part of that sale, and the two share vocabulary and little else. - **Price:** Quote — Quote-only. Available on-premises or as PKI as a Service — check the managed option’s region list if Indian residency binds you - **Details:** https://www.thetechbag.com/entrust/entrust-pki ### Entrust Certificate Manager — Entrust - **Who it's for:** Anyone who cannot confidently list their certificates — which is usually discovered through an outage rather than through planning. Expired certificates cause a disproportionate share of unplanned downtime, and the cause is never the cryptography: it is that nobody knew the certificate existed until it stopped working. The DISCOVERY half matters more than the renewal half, because a renewal process only covers certificates you already know about. - **The honest limitation:** It manages certificates; it does not issue trust — a CA still sits behind it, public or private. And if your estate is genuinely small and stable, a maintained spreadsheet with calendar reminders is not a ridiculous answer and we would say so rather than sell you a platform you do not need yet. - **Price:** Quote — Quote-only. Discovery, inventory, automated renewal and revocation across the certificates scattered through a real estate - **Details:** https://www.thetechbag.com/entrust/entrust-certificate-lifecycle ### Microsoft Purview Information Protection — Microsoft - **Who it's for:** Microsoft estates sharing documents outside the organisation. The integration advantage is real and no third party can match it inside Microsoft 365 — and India is an eligible Local Region Geography under Advanced Data Residency, with Information Protection in scope as of February 2026, which most of this category cannot offer at all. Message Encryption also lets external recipients open protected email with a one-time passcode and no software installed. - **The honest limitation:** REVOCATION IS PARTIAL, not absolute: a revoked document stays readable until the recipient’s offline policy period expires, and files uploaded to SharePoint or OneDrive lose the content identifier and cannot be tracked or revoked AT ALL — which in a Microsoft estate is where documents routinely end up. Double Key Encryption gives you one of the two keys but disables co-authoring, SharePoint/OneDrive processing, search, eDiscovery and Copilot, and is Windows Office only. Format coverage is strong on Office and PDF and narrower beyond — for CAD, see Seclore. And the ADR conditions are strict: all users in the tenant, and tenant default geography India. - **Price:** $12 (≈ ₹11,952) — per user / MONTH published for the Microsoft 365 E5 Compliance add-on over E3 (~$144/user/year); full E5 is $60/user/month after the July 2026 increase. But check your entitlement FIRST — manual sensitivity labels and RMS encryption are already included in E3, and in most estates they are sitting unconfigured. The add-on buys automatic labelling, trainable classifiers, exact data match and Double Key Encryption - **Details:** https://www.thetechbag.com/microsoft/microsoft-purview ### Seclore ARMOR EDRM — Seclore - **Who it's for:** Indian BFSI and manufacturing estates that share confidential documents outside the organisation routinely and need the protection to survive the file leaving — with the vendor, the keys and the support in the same country. - **The honest limitation:** Rights management is only as good as its adoption: protection applied manually is applied rarely, so it needs to be driven by a classification or DLP decision rather than by users remembering. Narrower than a global suite on adjacent capabilities — this is a specialist, not a platform. - **Price:** Quote (INR) — quoted per protected user in INR from the Mumbai-built vendor, SaaS or self-hosted; policy travels inside the file with usage controls, expiry and post-distribution revocation across Office, PDF, CAD and arbitrary formats - **Details:** https://www.thetechbag.com/seclore/seclore-edrm ### Seclore ARMOR Data Classification — Seclore - **Who it's for:** Estates deploying Seclore EDRM that need the protection triggered by a rule rather than a person — the piece that turns rights management from optional into automatic. - **The honest limitation:** Classification is not a protection control by itself: it labels and hands off. Bought alone it produces labels nothing acts on. - **Price:** Quote (INR) — quoted per user in INR; labelling at creation and at rest that decides which documents get protected, feeding the rights-management engine automatically rather than relying on the author - **Details:** https://www.thetechbag.com/seclore/seclore-data-classification ### Trellix Data Encryption — Trellix - **Who it's for:** Estates whose requirement is the lost-laptop and stolen-USB scenario — device-level encryption with a central place to recover keys when someone leaves or forgets a passphrase. - **The honest limitation:** Encryption at rest on devices you manage: it protects the disk, not the file once a legitimate user copies it elsewhere. It does not answer the after-it-leaves question at all — that is the row above. - **Price:** Quote — quoted per endpoint, managed from the Trellix ePO console; full-disk, file and removable-media encryption with central key escrow and recovery - **Details:** https://www.thetechbag.com/trellix/trellix-data-encryption ### Trellix Database Security — Trellix - **Who it's for:** Estates whose sensitive data is structured and sitting in databases, where the control needs to sit at the data layer rather than on the endpoint. - **The honest limitation:** Database-scoped, on-premises oriented, and it is monitoring and protection rather than rights management — the file exported from the database is outside its control entirely. - **Price:** Quote — quoted per database instance; activity monitoring, vulnerability assessment and protection for database contents at rest, without changing the application - **Details:** https://www.thetechbag.com/trellix/trellix-database-security ### Seqrite Encryption — Seqrite - **Who it's for:** Indian mid-market estates that need documented device encryption for an audit, at a price and on an agent they may already be running. - **The honest limitation:** Device encryption only, on the Seqrite agent: no file-level rights, no revocation, and no protection once a file is legitimately copied off the device. It answers the compliance question about lost devices and nothing beyond it. - **Price:** Quote (INR) — quoted per endpoint in INR, frequently bundled with Seqrite endpoint protection; full-disk and removable-media encryption with central policy and key recovery from the India-built vendor - **Details:** https://www.thetechbag.com/seqrite/seqrite-encryption ### Forcepoint Data Classification — Forcepoint - **Who it's for:** Forcepoint estates that want one classification decision made once and honoured by every control in the portfolio, rather than each product deciding separately. - **The honest limitation:** A labelling layer, not a protection control: it decides what a document is and hands the enforcement to DLP. Bought alone it produces metadata with nothing acting on it. India residency is not documented. - **Price:** Quote — quoted within the Forcepoint data-security portfolio; user-driven and automated labelling that drives Forcepoint DLP policy and downstream protection decisions - **Details:** https://www.thetechbag.com/forcepoint/forcepoint-data-classification ### OpenText Voltage SecureData (SecureData Servers) — OpenText - **Who it's for:** Teams that must protect card, account and ID numbers inside applications, databases and warehouses without breaking them — NIST FF1 format-preserving encryption keeps a 16-digit number at 16 digits, with stateless tokenisation and keys derived on demand. KuppingerCole named OpenText an overall Leader in its 2025 Data Security Platforms Leadership Compass. - **The honest limitation:** Field-level data protection, not rights management: it does not follow a document out of your estate, and applications call its APIs or SDKs to protect and reveal values. FIPS 140-2 certificate #2686 moved to NIST’s historical list in April 2026 with no 140-3 certificate found, and leaving means detokenising first. - **Price:** Quote — quote-only, scoped by key and protection servers, the integrations you need (Snowflake, BigQuery, Databricks, Teradata and others), the Sentry gateway for SaaS apps and z/Protect for mainframes; virtual appliances or Kubernetes, on-premises or from the AWS, Azure and Google marketplaces - **Details:** https://www.thetechbag.com/opentext/opentext-voltage-securedata ### WatchGuard Full Encryption — WatchGuard - **Who it's for:** WatchGuard endpoint estates that want lost-laptop encryption and recovery-key escrow without a separate encryption product. - **The honest limitation:** Device encryption only (BitLocker), so files are unprotected once copied off; no macOS full-disk encryption is claimed and WatchGuard Cloud has no Indian region. - **Price:** Quote — per endpoint, quoted — an add-on to WatchGuard Endpoint Security that manages Windows BitLocker from WatchGuard Cloud, with recovery keys held in the console - **Details:** https://www.thetechbag.com/watchguard/watchguard-full-encryption ### Matrix42 Endpoint Data Protection (formerly EgoSecure) — Matrix42 - **Who it's for:** Organisations, often already on Matrix42 UEM, that need laptop and USB encryption, port and device control and an audit trail of data movement on Windows endpoints, run on their own servers. - **The honest limitation:** An endpoint encryption and device-control suite, not rights management: protection does not follow a file to an outside recipient, there is no revocation, and no content classification or India presence is documented. - **Price:** Quote — quote-only; full-disk encryption with pre-boot authentication, file, folder, removable-media and cloud-folder encryption, plus device, port and application control, managed from an on-prem server or alongside Matrix42 UEM as Secure UEM - **Details:** https://www.thetechbag.com/matrix42/matrix42-endpoint-data-protection ### Fortra Data Classification — Fortra - **Who it's for:** Manufacturers and defence suppliers whose sensitive files include CAD drawings, Visio, Project or Lotus Notes, or whose contracts call for STANAG, ITAR or controlled unclassified information markings, and who want the policy server on their own premises. - **The honest limitation:** A labelling layer, not a protection control: the label is metadata that DLP, the mail gateway or encryption must act on. Two suites from two acquisitions are licensed separately, both are quote-only, no India SaaS region is published, and Secure Collaboration, which added rights management, has left Fortra's product menu. - **Price:** Quote — quoted per suite with no published meter; Data Classification Suite and Classifier Suite label email, Office files, CAD drawings and files at rest, on-premises or as SaaS, with labels read by Fortra DLP and Fortra Secure Email Gateway - **Details:** https://www.thetechbag.com/fortra/fortra-data-classification ## Why each constraint rules out what it does The full narrowing logic, as prose. Nothing here is hidden behind an interaction. **protection that travels.** Rules out Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Entrust Certificate Manager, Seclore ARMOR Data Classification, Trellix Data Encryption, Trellix Database Security, Seqrite Encryption, Forcepoint Data Classification, OpenText Voltage SecureData (SecureData Servers), WatchGuard Full Encryption, Matrix42 Endpoint Data Protection (formerly EgoSecure) and Fortra Data Classification — protects data inside your boundary; a legitimate copy taken elsewhere is unprotected. That leaves Microsoft Purview Information Protection and Seclore ARMOR EDRM. **revocation after delivery.** Rules out ESET PROTECT Advanced, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Seclore ARMOR Data Classification, Trellix Data Encryption, Trellix Database Security, Seqrite Encryption, Forcepoint Data Classification, OpenText Voltage SecureData (SecureData Servers), WatchGuard Full Encryption, Matrix42 Endpoint Data Protection (formerly EgoSecure) and Fortra Data Classification — no revocation after distribution; Microsoft Purview Information Protection — revocation documented, but not for copies already downloaded. That leaves Thales CipherTrust Secrets Management, HashiCorp Vault, Entrust PKI, Entrust Certificate Manager and Seclore ARMOR EDRM. **no software for recipients.** Rules out Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Seqrite Data Privacy, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Trellix Data Encryption, Seqrite Encryption, OpenText Voltage SecureData (SecureData Servers), WatchGuard Full Encryption and Matrix42 Endpoint Data Protection (formerly EgoSecure) — the recipient needs an agent or client installed. That leaves Thales CipherTrust Data Discovery and Classification, Entrust Certificate Manager, Microsoft Purview Information Protection, Seclore ARMOR EDRM, Seclore ARMOR Data Classification, Trellix Database Security, Forcepoint Data Classification and Fortra Data Classification. **any file format.** Rules out Microsoft Purview Information Protection, Seclore ARMOR Data Classification and Forcepoint Data Classification — documented for Office and PDF; other formats are not covered. That leaves Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Entrust Certificate Manager, Seclore ARMOR EDRM, Trellix Data Encryption, Trellix Database Security, Seqrite Encryption, OpenText Voltage SecureData (SecureData Servers), WatchGuard Full Encryption, Matrix42 Endpoint Data Protection (formerly EgoSecure) and Fortra Data Classification. **CAD formats.** Rules out Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Entrust Certificate Manager, Microsoft Purview Information Protection, Seclore ARMOR Data Classification, Trellix Data Encryption, Trellix Database Security, Seqrite Encryption, Forcepoint Data Classification, OpenText Voltage SecureData (SecureData Servers), WatchGuard Full Encryption and Matrix42 Endpoint Data Protection (formerly EgoSecure) — CAD formats are not documented. That leaves Seclore ARMOR EDRM and Fortra Data Classification. **a protection control.** Rules out Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Entrust Certificate Manager, Seclore ARMOR Data Classification, Forcepoint Data Classification and Fortra Data Classification — classification labels the file and hands enforcement elsewhere. That leaves Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Microsoft Purview Information Protection, Seclore ARMOR EDRM, Trellix Data Encryption, Trellix Database Security, Seqrite Encryption, OpenText Voltage SecureData (SecureData Servers), WatchGuard Full Encryption and Matrix42 Endpoint Data Protection (formerly EgoSecure). **SaaS — nothing of ours to host.** Rules out Thales Luna HSM, Entrust nShield HSM, Trellix Database Security, OpenText Voltage SecureData (SecureData Servers) and Matrix42 Endpoint Data Protection (formerly EgoSecure) — on-premises deployment only. That leaves Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Thales CipherTrust Manager, Thales CipherTrust Transparent Encryption, Entrust PKI, Entrust Certificate Manager, Microsoft Purview Information Protection, Seclore ARMOR EDRM, Seclore ARMOR Data Classification, Trellix Data Encryption, Seqrite Encryption, Forcepoint Data Classification, WatchGuard Full Encryption and Fortra Data Classification. **Keys held only by us, never the vendor.** Rules out Microsoft Purview Information Protection, Seclore ARMOR EDRM, Seclore ARMOR Data Classification, Forcepoint Data Classification, WatchGuard Full Encryption and Fortra Data Classification — the vendor can hold the keys in the default deployment; customer-held is available on request. That leaves Thales CipherTrust Secrets Management, HashiCorp Vault, ESET PROTECT Advanced, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Entrust Certificate Manager, Trellix Data Encryption, Trellix Database Security, Seqrite Encryption, OpenText Voltage SecureData (SecureData Servers) and Matrix42 Endpoint Data Protection (formerly EgoSecure). **India.** Rules nothing out on published terms. It flags Thales CipherTrust Secrets Management — Data region documented, HashiCorp Vault — Data region documented, ESET PROTECT Advanced — India residency for the policy server and key material is not documented, Thales CipherTrust Data Discovery and Classification — Data region documented, Thales CipherTrust Manager — Data region documented, Thales Luna HSM — Data region documented, Thales CipherTrust Transparent Encryption — Data region documented, Entrust nShield HSM — Data region documented, Entrust PKI — Data region documented, Entrust Certificate Manager — Data region documented, Microsoft Purview Information Protection — Data region documented, Trellix Data Encryption — India residency for the policy server and key material is not documented, Trellix Database Security — India residency for the policy server and key material is not documented, Forcepoint Data Classification — India residency for the policy server and key material is not documented, OpenText Voltage SecureData (SecureData Servers) — India residency for the policy server and key material is not documented, WatchGuard Full Encryption — India residency for the policy server and key material is not documented, Matrix42 Endpoint Data Protection (formerly EgoSecure) — India residency for the policy server and key material is not documented and Fortra Data Classification — India residency for the policy server and key material is not documented — marked, not removed. **documented offline behaviour.** Rules out Thales CipherTrust Secrets Management, HashiCorp Vault, Thales CipherTrust Data Discovery and Classification, Seqrite Data Privacy, Entrust Certificate Manager, OpenText Voltage SecureData (SecureData Servers), Matrix42 Endpoint Data Protection (formerly EgoSecure) and Fortra Data Classification — offline behaviour is not documented; confirm before relying on it; Trellix Database Security — not applicable: this control does not travel with files. That leaves ESET PROTECT Advanced, Thales CipherTrust Manager, Thales Luna HSM, Thales CipherTrust Transparent Encryption, Entrust nShield HSM, Entrust PKI, Microsoft Purview Information Protection, Seclore ARMOR EDRM, Seclore ARMOR Data Classification, Trellix Data Encryption, Seqrite Encryption, Forcepoint Data Classification and WatchGuard Full Encryption. **Only one product here survives the file leaving.** Seclore ARMOR EDRM is the only product on this page whose protection travels inside the file. The others encrypt storage, encrypt devices or label documents — all valuable, none of them answering the after-it-leaves question. **The external recipient decides adoption.** If the person you send a protected file to cannot open it easily, the process is abandoned within weeks and people revert to unprotected email. This is the variable that decides deployments, and it is under-weighted in almost every evaluation. **Classification is the trigger, not the control.** Two of these six are labelling layers. They decide which documents get protected and hand the enforcement elsewhere. Bought alone they produce metadata that nothing acts on. **Every product here runs on-premises, and every one allows customer-held keys.** That is unusual and worth stating: it is not a variable that narrows this shortlist. What does narrow it is whether protection survives the file leaving, and what the external recipient has to do. **Encryption at rest is usually already on.** Your storage layer, your cloud provider and your device management probably already encrypt at rest. If that is the requirement, check before buying — and note that it stops none of the scenarios that bring people to this page. ## Eight situations, and what each one buys If one of these is your sentence, the shortlist is short — frequently one product. ### A confidential file went outside and we need it back **Shortlist:** Seclore ARMOR EDRM **Why:** Revocation after distribution is documented, and it is the only product here whose protection persists outside your estate. **Trade-off:** Confirm in writing whether revocation reaches a copy already downloaded and held offline — that is the scenario people picture when they buy this. ### Files legitimately go to external auditors and consultants **Shortlist:** Seclore ARMOR EDRM, Seclore ARMOR Data Classification **Why:** Protect-and-send rather than block-or-allow, with expiry when the engagement ends and no software for the recipient to install. **Trade-off:** Needs the classification half to trigger protection automatically; applied by hand, it is applied rarely. ### A laptop was lost and we need to prove the data was safe **Shortlist:** Trellix Data Encryption, Seqrite Encryption **Why:** Full-disk encryption with central key escrow — the documented answer to the lost-device audit question. **Trade-off:** Protects the device, not the file. A legitimate copy taken elsewhere is unprotected, which is a different problem entirely. ### Removable media leaves the building routinely **Shortlist:** Trellix Data Encryption, Seqrite Encryption **Why:** Media encryption with central policy means the stick is unreadable off your estate without the key. **Trade-off:** The recipient needs the agent or the recovery process; this is not a way to share files with outsiders. ### Our confidential documents are engineering drawings **Shortlist:** Seclore ARMOR EDRM **Why:** CAD and arbitrary formats are documented, where the classification layers here cover Office and PDF only. **Trade-off:** Prove your specific CAD applications in a proof of concept — format support is version-specific in practice. ### The sensitive data is structured, in databases **Shortlist:** Trellix Database Security **Why:** Protection and activity monitoring at the data layer, without changing the application. **Trade-off:** On-premises oriented, and the file exported from the database is outside its control entirely. ### The keys and the vendor must be in India **Shortlist:** Seclore ARMOR EDRM, Seclore ARMOR Data Classification, Seqrite Encryption **Why:** All three are India-built, quote in INR, and offer self-hosted deployment with customer-held keys. **Trade-off:** Both vendors are narrower than a global suite on adjacent capabilities — specialists rather than platforms. ### Protection is applied by hand, so it is barely applied **Shortlist:** Seclore ARMOR Data Classification, Forcepoint Data Classification **Why:** Labelling at creation and at rest triggers protection by rule rather than relying on the author to remember. **Trade-off:** Neither is a control on its own — each hands enforcement to something else, and produces only metadata if bought alone. ## At scale Rights management scales by protected users and by how automatic the protection is. ### 1 protected users — One team, one document type - Manual protection is workable at this size - Legal or finance is the usual first team - The external-recipient test still decides everything **The test:** Run the recipient test with a real outside party before widening. ### 2 protected users — Several departments - Manual application starts failing — people forget - Classification becomes the trigger, not a nice-to-have - Format coverage beyond Office starts to matter **The test:** Automate the trigger before adding the second department. ### 3 protected users — Estate-wide, externally facing - Protection must be driven by DLP or DSPM decisions - Key management needs a named owner - Revocation gets used in anger, so test it properly **The test:** Name the key-management owner. Nobody does until it matters. ### 4 protected users — Regulated, with retention obligations - Self-hosted and customer-held keys become the requirement - Audit evidence of access and revocation is the deliverable - Exit planning matters — what happens to protected files later **The test:** Ask what happens to protected files if you stop paying. Where a vendor does not publish deployment-scale evidence, this page says so rather than implying it. ## Getting out This is the one category on the site where leaving badly can make your own data unreadable. **Protected files** — Every protected document depends on a policy server and keys that must keep answering *(Bulk-decrypt before leaving)* **Encryption keys** — Customer-held keys are portable; vendor-held keys are the whole risk of this row *(Depends who holds them)* **Classification labels** — Microsoft Information Protection labels are the nearest thing to a standard and travel reasonably *(Partly portable)* **Policy definitions** — Vendor-specific and rebuilt in the next product *(Not portable)* Ask this question before signature, not at renewal: what happens to files already protected if the contract ends? The answer should be a documented bulk-decryption process, and you should hold the keys. ## What it costs Per protected user for rights management, per endpoint for encryption. ### Do you already own one? Four checks, in the order most likely to return a yes. - **Microsoft Purview — Already encrypting Office files, if you hold E5.** E5 includes sensitivity labels with **Information Protection encryption** that travels with Office files. **Its limits are format and ecosystem** — strong for Office and PDF inside the Microsoft world, thin for CAD and arbitrary formats. - **Your storage or cloud provider — Encryption at rest is on by default nearly everywhere.** If the requirement is the lost-drive scenario at the storage layer, it is already covered and needs no purchase. - **Your device management — BitLocker and FileVault are managed by most UEM platforms.** Full-disk encryption with key escrow is frequently a policy switch in a tool you already run. - **Your endpoint suite — Seqrite and Trellix both sell encryption on their existing agents.** If either is already deployed, device encryption is a module rather than a new agent. The pattern here is unusual: for encryption the answer is very often yes, and for rights management it is very often no. Separate the two before shortlisting. ### What the rest actually cost Quote-led, and the India-built options quote in rupees. ### What isn't in the licence price - **Key-management ownership.** Somebody has to own keys, escrow and recovery. Unowned until a laptop is wiped or an employee leaves, and then urgent. - **The external-recipient trial.** Testing with real outside parties on machines you do not manage. Skipped almost universally, and the reason deployments fail. - **Classification to trigger protection.** Manual protection is rarely applied. The trigger is usually a second purchase. - **Format proof of concept.** CAD and specialist formats are version-specific in practice. Prove your actual applications. ## What goes wrong Five ways this purchase goes wrong. The first is the one that ends deployments. - **External recipients cannot open protected files.** They ask what this is, someone sends an unprotected copy to unblock the meeting, and the informal rule becomes not to protect anything anyone outside needs to read. - **Protection applied manually, so applied rarely.** If a person has to remember, they will not. Protection has to be triggered by a classification or DLP decision to reach meaningful coverage. - **Revocation that does not reach a downloaded copy.** The scenario people picture when buying is a file already on someone's laptop. Confirm that specific case in writing — it is where implementations differ most. - **Key management nobody owns.** Escrow and recovery are unassigned until an employee leaves or a device is wiped, and then it is an incident rather than a process. - **Buying rights management when the requirement was encryption at rest.** Which the storage layer, the cloud provider and the device management already do. Separate the three jobs before shortlisting anything. ## Questions this guide answers ### What is the difference between encryption and rights management? Encryption protects a container — a disk, a volume, a removable drive, a database — so a stolen device or a raw storage dump is unreadable. Rights management puts the policy inside the document itself, so the rules are enforced on a recipient's machine in an organisation you do not control. Disk encryption does nothing at all once a legitimate user copies a file elsewhere; that is exactly the gap rights management exists to close. ### Can I revoke access to a file someone has already downloaded? That is the reason to buy rights management, and it is the capability to confirm in writing rather than assume. Seclore ARMOR EDRM documents post-distribution revocation. The specific case to put to any vendor is a copy already downloaded to an external recipient's laptop and held offline — implementations differ most precisely there, and it is the scenario buyers picture when they sign. ### Do recipients need to install software to open protected files? It depends on the product, and it is the variable that decides whether the deployment survives. If opening a protected file requires an external party to install a viewer or create an account, people revert to unprotected email within weeks. Test this with a real outside party on a machine you do not manage during the proof of concept — a demonstration on your own network with your own software installed answers a different question. ### Isn't encryption at rest enough? For the lost-laptop and stolen-drive scenario, usually yes — and you almost certainly already have it from your storage layer, cloud provider or device management, at no additional cost. It stops none of the scenarios that bring people to this page: a legitimate user copying a file to a personal drive, a document forwarded to a competitor, an auditor keeping records after the engagement ended. Anyone with a valid session reads plaintext. ### What happens to protected files if we stop paying? Ask before signature, not at renewal. Protected documents depend on a policy server and keys that must keep answering — if they stop, the files may become unreadable to you as well. The answer you want is a documented bulk-decryption process and customer-held keys. Seclore offers self-hosted deployment with customer-held keys, which is the configuration that makes this question answerable on your terms. --- *Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.* *TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/data-security-privacy/encryption-rights*