Every other control protects data while it is inside your boundary. This is the only one that still works after the file has left.

Quote-only, licensed by the applications and workloads that authenticate to it rather than by data volume; centralises API keys, database passwords, certificates and tokens so they stop living in config files, environment variables and CI/CD settings

Estates where the real exposure is not encrypted-at-rest data but the long-lived credential sitting in a repository. Leaked credentials in source control are one of the most reliably exploited initial-access routes there is, and the credential is usually shared widely and rotated never. This replaces that with centrally issued, scoped, rotatable secrets — and it roots into the same CipherTrust key custody as the rest of the platform.

The catch: This is infrastructure credential hygiene, NOT document protection — it will not follow a file anywhere, and if that is your problem you want EDRM. It also competes directly with HashiCorp Vault, which has a free self-hostable edition and a far larger engineering community; the case for buying it from Thales is that you already run CipherTrust and want one key-custody story rather than two.

Community edition is free and self-hostable; HCP Vault is managed and quoted, Enterprise is quoted per cluster. Metering is on clients rather than data volume — an application or workload that authenticates to Vault

Engineering-led estates that need encryption-as-a-service and key custody under their own control rather than a document-protection product. Vault issues and rotates keys, encrypts data on behalf of applications without ever handing them the key material, and can run entirely on your own infrastructure in India — which is the cleanest answer to a DPDP or RBI question about who holds the keys.

The catch: This is NOT rights management and will not protect a document that leaves your estate — different problem, different product. It is also operationally heavy: Vault is a distributed system with unseal, replication and upgrade responsibilities, and teams underestimate that consistently. HashiCorp is now an IBM company, so weigh roadmap direction accordingly.

per device per year on PUBLIC list pricing — the only published price in this guide. Full-disk encryption is bundled into the endpoint-protection tier rather than sold as a separate SKU, alongside cloud sandboxing

Organisations whose actual encryption requirement is the laptop that gets left in a taxi, not inter-company document control. Full-disk encryption is what turns a lost device from a reportable breach into an inventory problem under DPDP — and buying it inside the endpoint suite you were purchasing anyway is materially cheaper than a standalone encryption product.

The catch: Full-disk encryption protects data AT REST ON THE DEVICE and nothing else. The moment a file is copied off, emailed or uploaded it is plaintext again — there is no travelling policy, no post-distribution revocation, and no control over the recipient. If your problem is documents leaving the organisation, this is the wrong category entirely; look at EDRM.

Quote-only, scoped by the data stores scanned; scans structured and unstructured stores to find sensitive data and label what it finds, feeding the rest of the CipherTrust platform

The estate that has bought encryption and cannot confidently say what it is pointed at. Every other control on this page — encryption, access policy, key management — has to be aimed at something, and aiming it at an asset inventory nobody trusts is how encryption programmes quietly miss the data that mattered. Under the DPDP Act the first practical question is what personal data you hold and where, which is this product’s output rather than a by-product.

The catch: Classification is not protection — it labels and hands off, and bought alone it produces an inventory nothing acts on. It is also the least glamorous line in a proposal and the first one cut, which is usually the decision that undermines everything bought alongside it.

Quoted in INR by an India-built vendor (Quick Heal), SaaS or on-premises; scoped around discovering and classifying personal data rather than encrypting documents

Indian organisations working out what the DPDP Act actually requires of them. Before you can protect personal data you have to find it and know what it is, and this is the discovery-and-classification half of that problem from a vendor headquartered in Pune with Indian support and INR invoicing.

The catch: Classification is not protection. It tells you where personal data lives and labels it — it does not encrypt the file, does not travel with it, and cannot revoke access after distribution. It is the input to a protection decision, so pair it with EDRM or DLP or the labels achieve nothing on their own.

Quote-only. Deploys as a virtual appliance or physical hardware, and can be rooted in a Luna HSM so master keys never exist in software. Licensed by scope — the hosts, databases or applications protected — rather than by data volume

The buyer whose regulator has stopped asking whether data is encrypted and started asking who can decrypt it. Cloud providers encrypt at rest by default and it protects against exactly one thing, a stolen disk — it does nothing about the provider, who holds the key. CipherTrust Manager makes the keys yours, under your policy, on infrastructure you operate, so the answer to an auditor is a demonstration rather than a contract clause.

The catch: This protects infrastructure, not documents — it will not follow a file that leaves your estate, and if that is your problem you want EDRM instead. CipherTrust as-a-Service is EU/NA only with NO India region, so residency-bound buyers deploy on-premises. And be precise about a fact this market blurs: Thales has 2,200+ staff in India with Noida as its Cyber & Digital centre, but people in India and data in India are different things.

Quote-only, and it is a capital purchase rather than a subscription — an appliance price plus a support contract, and more than one unit if you want to survive a site failure

Indian BFSI, government and defence-adjacent buyers whose regulator asks specifically about hardware key protection, and payments or PKI use cases with an explicit HSM mandate. Keys are generated inside tamper-resistant hardware and never leave in usable form, so compromising the server that calls the HSM does not yield the key. It is also the strongest possible answer to an Indian residency question — the key is in a physical box in your data centre.

The catch: This is an appliance, not software, and budgets go wrong in a predictable way: the purchase price gets captured and firmware maintenance, security-domain backup, separation of duties between administrators and approvers, and a second unit for resilience do not. Also worth raising early — Entrust’s nShield holds Bureau of Indian Standards certification. If BIS is a procurement requirement for you, that is a deciding fact rather than a preference.

Quote-only, typically licensed per protected host. An agent sits between the application and storage, so no application changes are required

Estates whose most sensitive systems are the ones nobody will modify. Encryption programmes stall because protecting data appears to require changing every application that touches it, and a fifteen-year-old line-of-business system is not getting refactored whatever the policy says. An agent leaves it untouched. The second capability matters as much: privileged-user access control lets a DBA administer a system without reading the data inside it — exactly the control an RBI or SEBI reviewer probes.

The catch: There is a performance overhead, and the only number that means anything is the one you measure on your own least-modern system rather than a clean test host. It also protects data at rest on infrastructure you control and nothing beyond that — a file exported by an authorised process is plaintext the moment it lands elsewhere.

Quote-only, and a capital purchase rather than a subscription — appliance price plus support, and more than one unit if you want to survive a site failure. Security World manages keys across a group of HSMs as one logical unit

Indian buyers where BUREAU OF INDIAN STANDARDS certification is in the tender. nShield Connect XC holds BIS and its closest competitor does not — and for Indian government and several BFSI procurement processes BIS is a GATE rather than a scoring criterion, meaning a product without it is not permitted regardless of merit or price. If BIS is in your requirements, this single fact settles the comparison before any feature is discussed.

The catch: An appliance, not software: budget firmware maintenance, Security World backup, separation-of-duties roles that did not previously exist, and a second unit for resilience. nShield as a Service has NO India region (UK/US/DE/AU), so India means on-premises. And on analyst standing we are being conservative — Gartner publishes no MQ for HSM or key management at all, and we could not verify an HSM Leader placement for Entrust with any analyst. Thales has the stronger verified position.

Quote-only. Available on-premises or as PKI as a Service — check the managed option’s region list if Indian residency binds you

Estates where machine identities are multiplying faster than anyone can issue certificates by hand. Private certificate authority for the machine identities, device certificates, internal TLS and code signing your own systems trust — with the trust model, issuance policy and validity periods defined by you rather than inherited from a commercial CA’s compliance record.

The catch: READ THE SCOPE: this is PRIVATE PKI. Entrust sold its entire public TLS certificate business to Sectigo in September 2025 after Chrome, Apple and Mozilla distrusted its roots — so publicly trusted SSL for an internet-facing site is no longer an Entrust product, whatever older search results say. Private PKI was not part of that sale, and the two share vocabulary and little else.

Quote-only. Discovery, inventory, automated renewal and revocation across the certificates scattered through a real estate

Anyone who cannot confidently list their certificates — which is usually discovered through an outage rather than through planning. Expired certificates cause a disproportionate share of unplanned downtime, and the cause is never the cryptography: it is that nobody knew the certificate existed until it stopped working. The DISCOVERY half matters more than the renewal half, because a renewal process only covers certificates you already know about.

The catch: It manages certificates; it does not issue trust — a CA still sits behind it, public or private. And if your estate is genuinely small and stable, a maintained spreadsheet with calendar reminders is not a ridiculous answer and we would say so rather than sell you a platform you do not need yet.

per user / MONTH published for the Microsoft 365 E5 Compliance add-on over E3 (~$144/user/year); full E5 is $60/user/month after the July 2026 increase. But check your entitlement FIRST — manual sensitivity labels and RMS encryption are already included in E3, and in most estates they are sitting unconfigured. The add-on buys automatic labelling, trainable classifiers, exact data match and Double Key Encryption

Microsoft estates sharing documents outside the organisation. The integration advantage is real and no third party can match it inside Microsoft 365 — and India is an eligible Local Region Geography under Advanced Data Residency, with Information Protection in scope as of February 2026, which most of this category cannot offer at all. Message Encryption also lets external recipients open protected email with a one-time passcode and no software installed.

The catch: REVOCATION IS PARTIAL, not absolute: a revoked document stays readable until the recipient’s offline policy period expires, and files uploaded to SharePoint or OneDrive lose the content identifier and cannot be tracked or revoked AT ALL — which in a Microsoft estate is where documents routinely end up. Double Key Encryption gives you one of the two keys but disables co-authoring, SharePoint/OneDrive processing, search, eDiscovery and Copilot, and is Windows Office only. Format coverage is strong on Office and PDF and narrower beyond — for CAD, see Seclore. And the ADR conditions are strict: all users in the tenant, and tenant default geography India.

quoted per protected user in INR from the Mumbai-built vendor, SaaS or self-hosted; policy travels inside the file with usage controls, expiry and post-distribution revocation across Office, PDF, CAD and arbitrary formats

Indian BFSI and manufacturing estates that share confidential documents outside the organisation routinely and need the protection to survive the file leaving — with the vendor, the keys and the support in the same country.

The catch: Rights management is only as good as its adoption: protection applied manually is applied rarely, so it needs to be driven by a classification or DLP decision rather than by users remembering. Narrower than a global suite on adjacent capabilities — this is a specialist, not a platform.

quoted per user in INR; labelling at creation and at rest that decides which documents get protected, feeding the rights-management engine automatically rather than relying on the author

Estates deploying Seclore EDRM that need the protection triggered by a rule rather than a person — the piece that turns rights management from optional into automatic.

The catch: Classification is not a protection control by itself: it labels and hands off. Bought alone it produces labels nothing acts on.

quoted per endpoint, managed from the Trellix ePO console; full-disk, file and removable-media encryption with central key escrow and recovery

Estates whose requirement is the lost-laptop and stolen-USB scenario — device-level encryption with a central place to recover keys when someone leaves or forgets a passphrase.

The catch: Encryption at rest on devices you manage: it protects the disk, not the file once a legitimate user copies it elsewhere. It does not answer the after-it-leaves question at all — that is the row above.

quoted per database instance; activity monitoring, vulnerability assessment and protection for database contents at rest, without changing the application

Estates whose sensitive data is structured and sitting in databases, where the control needs to sit at the data layer rather than on the endpoint.

The catch: Database-scoped, on-premises oriented, and it is monitoring and protection rather than rights management — the file exported from the database is outside its control entirely.

quoted per endpoint in INR, frequently bundled with Seqrite endpoint protection; full-disk and removable-media encryption with central policy and key recovery from the India-built vendor

Indian mid-market estates that need documented device encryption for an audit, at a price and on an agent they may already be running.

The catch: Device encryption only, on the Seqrite agent: no file-level rights, no revocation, and no protection once a file is legitimately copied off the device. It answers the compliance question about lost devices and nothing beyond it.

quoted within the Forcepoint data-security portfolio; user-driven and automated labelling that drives Forcepoint DLP policy and downstream protection decisions

Forcepoint estates that want one classification decision made once and honoured by every control in the portfolio, rather than each product deciding separately.

The catch: A labelling layer, not a protection control: it decides what a document is and hands the enforcement to DLP. Bought alone it produces metadata with nothing acting on it. India residency is not documented.