- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Entrust nShield HSM
Keys generated inside the appliance that never leave in usable form, managed across appliances by Entrust’s Security World. BIS registration is a mandatory safety gate that nShield and Thales Luna both clear — so the comparison turns on architecture, portfolio and analyst standing, not on BIS.
Data residency & processing — two different questions
Where data lives
Yours — on-premises appliances in India
nShield HSMs are physical appliances in your own data centre, and private PKI can run on-premises too. Keys are generated and held in hardware you own, in India, under your administrators — the proof is physical: the unit’s serial number with its access log, not contract language.
The constraint, stated plainly
No India region for the managed service
nShield as a Service runs in the UK, US, Germany and Australia. Entrust has live engineering hiring in Bengaluru and Pune, and that is people in India, not data in India — mistaking engineering headcount for a residency answer is the slip auditors catch.
For a residency-bound Indian buyer the answer is appliances you operate, which is very likely what your regulator wanted anyway. Note what does not exist so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant — and we could not verify an HSM Leader placement for Entrust with any analyst. A search caution specific to this vendor: “Entrust India” surfaces several unrelated companies, including a Bengaluru wealth manager, so check you are reading about Entrust Corporation before drawing conclusions.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Entrust portfolio
This page covers Entrust nShield HSM — hardware key custody. The rest of the Entrust portfolio on TechBag:
Quick facts
30-second orientation- Product
- Entrust nShield HSM
- BIS (India)
- IS 13252 safety registration — Connect XC since 2019
- What BIS is
- A mandatory safety gate — Thales Luna holds it too
- Current models
- nShield 5c (network) and 5s (PCIe) — succeed Connect XC / Solo XC
- Certification
- nShield 5: FIPS 140-3 Level 3, Common Criteria EAL4+
- Architecture
- Security World — keys across a group of HSMs
- Vendor
- Entrust — CEO Tony Ball, from 31 March 2026
- Ownership
- Private, via Datacard — Germany's Quandt family
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- Analyst standing
- No HSM/key-management Leader placement verified
- Client licences
- Network appliances include three; more are extra
- Data residency
- On-premises; nShield as a Service has no India region
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, BIS scoping
Understand hardware key custody before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
A hardware security module: a certified, tamper-resistant device in which keys are created, stored and used — applications send it data to sign or decrypt and get results back, never the key.
Software-held keys vs keys in an HSM — the honest table
What moving keys into hardware changes, dimension by dimension.
| Dimension | Software-held keys | nShield HSM |
|---|---|---|
| Where the key lives | In host memory or a key file | Inside a certified module |
| Compromised server | Can yield the key | Can request operations, not the key |
| Key backup | Copies on disks and in scripts | Encrypted under the Security World |
| Who can use a key | Whoever can read the file | Card-set quorum you define |
| Second site | Copy the key across | Enrol a second HSM in the World |
| Audit evidence | Configuration screenshots | Certified hardware and access logs |
| Indian tender requiring BIS | No appliance to register | Registered appliance — confirm by model |
| Cost | Low, mostly effort | Appliance, support and operations |
An HSM protects keys, not data on its own — it sits under your PKI, databases and signing systems. Software key management under your control is often enough, and TechBag will say so when it is.
The five pieces of an nShield deployment
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Certified Module
A FIPS 140-3 Level 3 module (nShield 5 family) generates keys inside the device and performs signing and decryption there, so keys never sit in host memory.
Security World
Application keys are stored encrypted under the Security World key, so any HSM enrolled in the same World can use them — the basis for load-sharing, failover and DR.
Card Sets & Quorum
Administrator and Operator Card Sets with K-of-N quorums decide who can recover the World or load a key — separation of duties enforced by the hardware.
Client APIs
Applications call the HSM through PKCS#11, Java JCE or Microsoft CNG; each host connecting to a network appliance uses a client licence, three included by default.
Form Factors
The nShield 5c network appliance, the nShield 5s PCIe card, or nShield as a Service from Entrust data centres — the same Security World model across all three.
Keys stay inside certified hardware; the Security World decides which HSMs may use them, and the card sets decide who may.
Twelve capabilities. Protect, operate, prove.
What nShield actually does — keys created and used inside certified hardware, shared across HSMs through the Security World, and evidenced for auditors and tenders.
Keys Born in Hardware
Keys are generated from the module’s certified random number generator and never leave in plaintext — what a regulator means by hardware key protection.
FIPS 140-3 Level 3
The nShield 5 family is certified to FIPS 140-3 Level 3, announced by Entrust in August 2024 — the standard most HSM tenders reference.
Common Criteria EAL4+ and eIDAS
nShield 5 HSMs hold Common Criteria EAL4+ certification, which is what EU eIDAS qualified-signature and seal services look for in a signing device.
BIS Safety Registration
BIS registration under IS 13252, a mandatory IT-equipment safety standard, covers nShield Connect XC since 2019; for the 5c, ask for the certificate by model.
One Key Domain Across HSMs
Keys encrypted under the Security World can be used by every enrolled HSM, so adding capacity or a second site does not mean moving key material by hand.
Load-Sharing and Failover
Several HSMs in one Security World serve the same keys, so applications keep signing when one unit fails or is taken down for a firmware update.
K-of-N Quorum Control
Recovery and use of the most sensitive keys can require several card holders at once, so no single administrator can act alone on them.
Run Code Inside the Boundary
CodeSafe lets custom application logic execute inside the HSM’s protected environment, for cases where the key is not the only thing worth protecting.
Published Integration Guides
Entrust publishes nShield integration guides for certificate authorities, including its own and Microsoft AD CS, plus databases and signing tools.
Tamper-Resistant, Tamper-Evident
A hardened enclosure resists and reveals physical tampering, and administrative actions are logged — evidence an auditor can inspect directly.
A Firmware Path to Post-Quantum
The nShield 5 processor is crypto-agile and firmware-upgradable; confirm which firmware release supports the post-quantum algorithms you need.
nShield as a Service
Dedicated nShield HSMs hosted by Entrust in the UK, US, Germany and Australia — useful outside India; for Indian residency the appliance is the answer.
Watch Entrust nShield HSM in action
The appliance, and the category it belongs to, from Entrust’s own channel.
Entrust nShield HSMs: On Another Level
The appliance, presented by Entrust.
What is a hardware security module (HSM)?
The category, explained.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Hosts get compromised. Keys should not.
Here’s what genuinely sets nShield apart.
BIS registration is a gate for every HSM, not a differentiator
BIS registration under IS 13252 is the IT-equipment safety standard of the Bureau of Indian Standards’ Compulsory Registration Scheme, mandatory for many IT products sold in India. nShield Connect XC was registered in 2019, and Thales lists India BIS for the Luna Network HSM in its product brief. So BIS is a threshold every candidate HSM must clear — not a security certification, and not a reason to choose one vendor over the other. What it does demand is precision: registration is by model, so get the certificate naming the exact appliance you will receive. The 2019 certificate covers Connect XC, and we have not confirmed the nShield 5c. Then compare on what actually differs.
Keys that cannot be extracted, by construction
The core argument for any HSM, stated plainly. Software key management can be excellent and is often sufficient, but its keys exist in memory on a host, and a sufficiently compromised host can yield them. Hardware removes that possibility architecturally: the key is generated inside the appliance, used inside it, and never leaves in usable form. Compromising the application server that calls the HSM buys an attacker the ability to request operations while that access lasts — it does not buy them the key. That distinction is what a regulator is reaching for when they ask specifically about hardware key protection rather than about encryption generally.
Security World makes resilience an architecture, not a retrofit
Entrust's Security World manages keys across a group of HSMs as one logical unit. Practically, that means a second appliance at another site is a design decision you make at the start rather than a painful exercise in moving key material later, and disaster recovery has a defined shape rather than being improvised. Anyone comparing nShield against Luna meets this concept in the first conversation, and it is a genuine architectural difference rather than marketing vocabulary.
The honest cost: an appliance, not software
HSM budgets go wrong in a predictable way — the hardware quote is captured and everything around it is not. There is a support contract. There is firmware maintenance on a security-critical device. There is backup of the Security World, which is its own discipline and genuinely unforgiving if neglected. There are separation-of-duties roles that did not previously exist, because the person administering the appliance should not be the person approving key use. And if you want to survive a data-centre failure, there is a second unit and somewhere to put it. None of it is exotic. All of it is real, and we would rather cost it with you now.
The honest positioning
Buy nShield when hardware key custody is genuinely required and Security World’s model of resilience fits how you want to run it, or when Entrust’s PKI or identity portfolio is part of your wider plan, since one vendor across those is simpler to manage. Look at Thales instead when you want the stronger verified analyst position or the broader software platform around the hardware. Either way, confirm BIS registration for the exact model you buy — both vendors hold it for their network HSMs, so it will not decide between them. And look at neither if software key management under your control would satisfy your actual requirement, which for many buyers it would — a smaller sale for us and frequently the right recommendation.
The numbers behind Entrust
What your nShield HSM journey looks like
Name what actually decides it
BIS registration is a mandatory safety gate that nShield and Thales Luna both clear, so it will not separate them. Write down what will: Security World fit, portfolio, analyst standing, price.
Match the model to the certificate
BIS registered the nShield Connect XC in 2019; its successor, the nShield 5c, we have not confirmed. Get the registration certificate naming the exact model before the bid goes in.
Decide whether hardware is genuinely required
Software key management under your control satisfies many requirements at a fraction of the cost. Hardware becomes necessary when keys must never exist in software — usually because a regulator asked specifically, a payments or PKI use case mandates it, or your risk assessment concluded it.
Design Security World and the second appliance
Resilience and disaster recovery depend on how the Security World is designed, and a second appliance at another site is far easier to plan now than to retrofit. Budget the unit, the site and the network between them.
Test the Security World restore
Back up the Security World and then actually restore from it in a test. An untested backup of a hardware key domain is an assumption, and it is the assumption that ends organisations rather than merely inconveniencing them.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“BIS registration was in the tender. Both shortlisted HSMs had it, so the Security World design decided it.”
“Moving our issuing CA keys onto the HSM took a weekend. Agreeing who holds the operator cards took a month.”
“Security World meant the second site was a design decision rather than a migration.”
“Budget the operations, not the appliance. The separation of duties took longer than the install.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the encryption and key-custody market — tap any vendor to see why it sits where it does.
TechBag Key-Custody Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Security World resilience; BIS-registered, like its peer.
Platform Breadth × Key Custody
How broad the software platform is vs how deep the hardware key custody goes.
Deepest on hardware custody; a lighter software platform around it.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Entrust nShield vs the key-custody field
Thales, Microsoft Purview, Seclore and HashiCorp Vault — honest lanes; the edge is certified hardware custody and Security World resilience; BIS registration is a gate both nShield and Luna clear.
| Dimension | Entrust | Thales | Microsoft Purview | Seclore | HashiCorp Vault |
|---|---|---|---|---|---|
| What it actually is | Network and PCIe HSMs, plus a hosted service | Key management, HSM and encryption platform | Document rights management | India-built EDRM | Secrets and encryption-as-a-service |
| BIS registration (India) | Connect XC registered (IS 13252, 2019); confirm the 5c | Luna Network HSM brief lists India BIS (IS 13252) | Not applicable | Not applicable | Not applicable |
| Hardware key custody | nShield, with Security World | Luna HSM | DKE holds one key; not an HSM product | Not an HSM vendor | Can integrate with an HSM |
| Verified analyst standing | None verified for HSM or key management | KuppingerCole Overall Leader 2025 ×2 | Microsoft, evaluated broadly elsewhere | Specialist — no Gartner EDRM MQ exists | Widely recognised in its category |
| Public TLS certificates | SOLD to Sectigo, Sept 2025 — no longer offered | Not a public CA | Not a public CA | Not a public CA | Not a public CA |
| India data residency | On-premises appliances — no India SaaS region | On-premises — no India SaaS region | India region via Advanced Data Residency | India-built; SaaS or self-hosted | Self-host anywhere, including India |
| Published pricing | Quote-only | Quote-only | $12/user/mo Purview add-on; E5 $60 | Quote (INR) | Free community edition |
| The thing to plan around | Confirm BIS covers the model you buy (5c vs Connect XC) | HSM operations: firmware, backup, separation of duties | DKE breaks co-authoring, search and Copilot | Adoption — manual protection is rarely applied | Operationally heavy to run well |
| Best fit | Security World resilience; Entrust PKI on the same hardware | Key custody with the broader software platform | Microsoft estates with E5 needing document labels | Documents shared outside, India-built vendor | Engineering-owned secrets and encryption services |
Which key-custody approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Entrust nShield if…
- ✓You want one vendor for HSM, PKI and identity
- ✓Keys must never exist in software
- ✓You want Security World resilience across sites
- ✓You will also root Entrust PKI in the same hardware
Thales Luna if…
- ✓You want the stronger verified analyst position and CipherTrust
HashiCorp Vault if…
- ✓Engineers own secrets and software key custody is enough
A cloud provider’s HSM if…
- ✓Workloads live in one cloud and its HSM service meets your residency rule
No HSM if…
- ✓No regulator, mandate or risk finding requires hardware keys
Entrust nShield HSM is one of 21 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (keys you handle by hand today; loaded engineer-hour cost). Estimates assume the rotation, backup and audit-evidence effort removed once keys live in a managed Security World — the larger, unpriced value is a key that cannot be extracted from a compromised host. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Entrust nShield is quote-priced (no public list) — by model (nShield 5c appliance, nShield 5s card or nShield as a Service), client licences, options such as CodeSafe, and support term. Budget the second unit and the operations too. TechBag right-sizes it and quotes in INR with GST.
nShield 5c
Best for a shared data-centre appliance
- Network-attached HSM for several applications
- FIPS 140-3 Level 3; three client licences included
- Pair a second unit for failover
nShield 5s
Best when one server needs an HSM inside it
- PCIe card installed in the host
- Same Security World model as the appliance
- Keys stay inside the card, not the server
nShield as a Service
Best outside India, without hardware to run
- Dedicated HSMs in Entrust data centres
- UK, US, Germany and Australia — no India region
- You keep control of the Security World
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every vendor
Take this into your next vendor call — including ours.
Does our tender require BIS registration (IS 13252) — and does every shortlisted HSM model hold it?
Does the BIS certificate name the exact nShield model we are buying — Connect XC or the newer 5c?
Do keys genuinely need to exist only in hardware, or would software key management under our control do?
Have we designed the key domain, and do we have a second appliance for resilience?
Who administers the appliance, and who approves key use? They must be different people.
Have we backed up the Security World AND tested restoring from it?
Are we deploying on-premises? nShield as a Service has no India region.
How many application hosts will connect? A network appliance includes three client licences; more cost extra.
Have we avoided implying a Gartner Leader placement? No MQ exists for this category.
Have we budgeted support, firmware, backup discipline and the second unit — not just the appliance?
Questions buyers ask
Ready to put your keys in hardware?
Confirm BIS registration for the exact model, size the appliances and the second site, or let a TechBag advisor cost the whole HSM programme with you.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.