- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Matrix42 Endpoint Data Protection
A laptop is left in a taxi and a USB stick walks out the door. Neither should carry readable data — Matrix42 Endpoint Data Protection, the former EgoSecure, encrypts disks, folders, USB drives and cloud folders with keys you hold, and decides which ports, devices and programs each user may use — all from a server you run.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Matrix42 platform family
This page covers Matrix42 Endpoint Data Protection — the endpoint encryption and device-control product, formerly EgoSecure. The rest:
Quick facts
30-second orientation- Product
- Endpoint encryption with device, port and application control; formerly EgoSecure Data Protection
- Maker
- Matrix42 GmbH, Frankfurt am Main; founded 1992, owned by Corten Capital, CEO Niilo Fredrikson
- Encryption
- Full disk behind pre-boot login; files, local folders, removable drives, cloud folders, Android and iOS
- Control
- Per-user rules for USB, Bluetooth, WiFi, smartphones and cloud storage, plus program allow-lists
- Audit
- Secure Audit records data movement; IntellAct compares it with normal values and raises triggers
- Price
- Not published; quoted on request, with each Matrix42 product free to try for 30 days
- Deployment
- An EgoSecure server you install; hybrid with Matrix42 UEM through the Unified User Experience console
- Keys
- Cloud-folder keys are “stored securely within your organization”, in Matrix42’s words
- India
- No Indian office, verified partner or data region; a server in your own data centre keeps keys local
- In India via
- TechBag — port and USB audit, quote in INR with GST, pilot on one department’s laptops
Understand endpoint encryption and device control before you buy them
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is endpoint data protection?
Encryption keeps data unreadable on a lost device, and device control decides where data may be copied in the first place.
Open USB ports and unencrypted laptops vs Matrix42 Endpoint Data Protection — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Open USB ports, unencrypted laptops | Matrix42 Endpoint Data Protection |
|---|---|---|
| A laptop goes missing | A reportable breach and a long audit | An encrypted disk behind a pre-boot login |
| Someone plugs in a USB stick | Anything copies, nothing is logged | Per-user rules, optional encryption, a log entry |
| Files in a synced cloud folder | Readable by whoever holds the account | Encrypted with keys kept in your organisation |
| Unapproved software | Found at licence-audit time | Blocked by a per-user program list |
| Unusual data movement | Noticed after the damage, if ever | IntellAct flags it against normal values |
| What it is NOT | — | Rights management, content-aware DLP, or a published price |
The cheapest test is the 30-day trial: one department, audit-only rules for a week, then encrypt five laptops and rehearse a key recovery.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Agent
An agent on every Windows PC enforces encryption, device and program rules locally and registers with the EgoSecure server; Matrix42 keeps separate update guides for agents.
Server
The server syncs your directory, holds tenants, administrators and licence activations, and keeps its data in a SQL database; Microsoft SQL Server and Azure SQL are both documented.
FDE
A separately installed Full Disk Encryption component locks the drive before Windows starts, with smart-card logon documented; a BitLocker Management module is the native route.
UUX
UUX extends the console across UEM and EgoSecure, and its service bus allows hybrid estates, for example EgoSecure and Empirum on-premises with Silverback in the cloud.
An agent on every Windows PC and a server you run — data encrypted at rest, every port and program under a rule.
Nine capabilities. Encrypt, control, audit.
Matrix42 Endpoint Data Protection encrypts what sits on your endpoints and controls every route data can take off them.
Locked before Windows loads
Full-disk encryption with Preboot Authentication keeps a stolen laptop’s drive unreadable even if Windows login is bypassed.
Folders and USB drives too
Local Folder, Removable Device and Permanent Encryption modes protect files and pen drives as well as the system disk.
Cloud copies, your keys
Folders synced to cloud storage are encrypted with keys Matrix42 says remain inside your organisation; a mobile app decrypts them.
Who may use which port
Rules decide which users can use Bluetooth, WiFi, smartphones and USB devices, and to what extent, on each endpoint.
Storage services in scope
The same access rules extend to cloud services and storage, so an upload channel can be limited like a USB port.
Only approved programs run
Per-user program allow and block lists stop unlicensed installs; a documented setup makes Empirum the only trusted installer.
A record of data movement
Data transfers are logged and stored under EU-GDPR rules, and access to the log can be limited to named team members.
Anomalies against a baseline
IntellAct Automation compares audit data with normal values, flags anomalies and fires predefined triggers without an admin.
Alerts that start a process
Workflow Studio can turn an IntellAct finding into further Matrix42 actions and processes, chosen by network status.
Watch Matrix42 Endpoint Data Protection in action
Matrix42 has published one official video on this product: a 2020 Experience Day session, in German and under the EgoSecure name, on why organisations deploy it and how they implement data protection. No newer or English video exists on the official channel.
Matrix42 Experience Day Digital - EgoSecure – Einsatzgründe und Umsetztung von Datenschutz
In German and from 2020, before the rename: why organisations deploy EgoSecure and how they put data protection into practice. It is the only official video on this product.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Encryption alone leaves the ports open. EDP encrypts the data and rules every exit.
Here’s what genuinely sets it apart — and exactly where it stops.
Encryption and port control from one agent
EDP does both jobs many tools split: whole-disk encryption behind a pre-boot login, folder and USB encryption, and per-user rules for Bluetooth, WiFi, phones and USB devices, from one agent and one console. One policy set covers the lost laptop and the copied file.
Keys and audit trail on servers you run
The EgoSecure server is software you install, so policy, the audit trail and recovery material sit in a data centre you pick, and Matrix42 says cloud-folder keys stay within your organisation. With no Matrix42 region in India, that is the residency route.
Built to sit beside Matrix42 UEM
Paired with Unified Endpoint Management, EDP becomes what Matrix42 calls Secure UEM, run through the Unified User Experience console. Application Control can make Empirum the only trusted installer, and IntellAct findings can start Workflow Studio processes.
Where it stops
It is device-level protection, not rights management: a file sent outside is not tracked or revocable, and no content classification is documented. Disk encryption is Windows-first, the price is quote-only, the one official video is German from 2020, and support keeps European hours.
The numbers behind the platform
What your Matrix42 Endpoint Data Protection rollout looks like
Map the devices and channels
List laptops, desktops and the USB, Bluetooth and cloud-storage use each team needs, so rules start from real work.
Place the server
Install the EgoSecure server in your Indian data centre, sync the directory and set tenants and administrator roles.
Audit before you block
Roll the agent to one department with Secure Audit on and rules permissive, and read where data actually moves.
Encrypt the pilot laptops
Turn on full-disk encryption with pre-boot login, run a Windows patch cycle on them, and rehearse a key recovery.
Tighten and widen
Switch USB and program rules to enforce, add IntellAct triggers, then extend group by group across the estate.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We set USB sticks to read-only for everyone except finance, and the audit log showed who still tried to copy to them.”
“A field engineer lost a laptop at a station. Pre-boot encryption made it a write-off for the asset team, not an incident.”
“Application Control finally stopped unlicensed tools appearing on shop-floor PCs; only Empirum packages install now.”
“Encrypting the synced cloud folder with our own keys answered the client’s question about the provider reading files.”
“A Windows update left two encrypted laptops unbootable until the knowledge-base fix went on. Pilot every patch ring first.”
“It does what we need, but support answers in European hours and the quote took weeks. Budget for that from India.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the endpoint encryption market — tap any vendor to see why it sits where it does.
TechBag Endpoint Encryption Grid
Execution strength vs product vision — the classic market map, minus the paywall.
EgoSecure heritage; sold mostly into Europe on quote.
Encryption Reach × Data-Path Control
The grid nobody publishes — how many places a product encrypts data vs how much control it gives over the ports, devices and programs data leaves through.
Disk, folder, USB, cloud folder; ports, devices, programs and audit.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Matrix42 Endpoint Data Protection vs the endpoint encryption field
Against Trellix Data Encryption, ESET PROTECT Advanced, Seqrite Encryption, WatchGuard Full Encryption and Safetica Platform — on engine, platforms, USB and port control, keys, price and India.
| Dimension | Matrix42 Endpoint Data Protection | Trellix Data Encryption | ESET PROTECT Advanced | Seqrite Encryption | WatchGuard Full Encryption | Safetica Platform |
|---|---|---|---|---|---|---|
| What it is | Encryption + port rules | Encryption family | Endpoint tier with FDE | India-built disk + USB | BitLocker add-on | DLP + insider risk |
| Deployment | Your EgoSecure server | ePO, on-prem or SaaS | Cloud or own server | Console here or hosted | Vendor cloud only | Cloud; On-Prem separate |
| Encryption engine | AES; own FDE | Certified own engine | FIPS 140-2, AES-256 | Choice of four ciphers | BitLocker only | Not documented |
| Platforms | Windows; mobile app | Windows and macOS | Windows, macOS 10.14+ | PCs and Macs (2018) | Windows; Mac unclear | Endpoints + M365, Google |
| Pre-boot authentication | Pre-boot, smart cards | Smart card, MFA | TPM and OPAL aware | Pre-boot login | PIN or passphrase | Not applicable |
| Removable media | Encrypt or restrict USB | Dedicated media product | Disks, not pen drives | USB + Traveller Tool | Prompts to encrypt USB | Controls, not encrypts |
| Device and port control | Ports, devices, cloud | Separate Device Control | Built into the agent | In Seqrite EPP tiers | In the endpoint tiers | USB, print, clipboard |
| Key custody and recovery | Keys kept in-house | ePO escrow, self-help | Kept in the console | Central recovery store | Cloud, by key ID | No keys to hold |
| Pricing model | Point product, quoted | Per endpoint, by product | Per device, whole tier | Per endpoint, quoted | Add-on, licence bands | Per user, three tiers |
| Published entry price | Not published | Not published | ~$55/device/year | Not published | Not published | From $72/user/year |
| Included vs add-on | Modules in one product | Pick and combine | FDE inside the tier | Separate product | Base licence required | Tiers add features |
| India key location | Your server in India | ePO on your servers | On-prem console option | Pune-built, on-prem | No India region | On-Prem for residency |
| Lock-in and exit | Own FDE format | Own engine or native | ESET format on Windows | Proprietary format | Standard BitLocker | Nothing encrypted |
| Best fit | Matrix42 UEM estates | Standardised on ePO | Price before the call | Local vendor wanted | WatchGuard MSP clients | Leak channels first |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Matrix42 EDP if…
- ✓You want disk, folder, USB and cloud-folder encryption and per-user port and device rules from one agent and one console
- ✓Keys, policy and the audit trail have to stay on a server you run, in India or anywhere else you choose
- ✓You already run Matrix42 UEM or service management and want endpoint incidents to start workflows there
Compare alternatives if…
- ✓You need full-disk encryption on Macs as well as PCs — Trellix and ESET document both
- ✓You want a price before a sales call — ESET PROTECT Advanced and Safetica publish theirs
- ✓You want a local vendor with Indian support and INR billing — Seqrite is built in Pune
Do not expect…
- ✓Protection that follows a file to an outside recipient, or revocation after it is sent
- ✓Content classification or a content-aware DLP engine
- ✓An Indian Matrix42 office, partner or hosted region, or support outside European hours
Matrix42 Endpoint Data Protection is one of 21 encryption & rights management products TechBag carries. The Encryption & Rights Management guide narrows them to a shortlist and shows the reasoning. →
What does unmanaged endpoint data cost you?
Drag the sliders (endpoints you protect; IT staff-hour cost). Estimates model the staff time spent on USB exception requests, lost-device reports and gathering evidence of who copied what, at an assumed 1.5 hours per endpoint a year, with 70% of it saved by central encryption, port rules and an audit trail. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Matrix42 publishes no price for Endpoint Data Protection: its pricing page lists it among five point products sold through a quote request, and the pricing FAQ offers each product free for 30 days. It can also be bought with Unified Endpoint Management as the Secure UEM bundle, and Premium Services (24/7 priority support) is an add-on. Matrix42 shows no rupee or dollar price and has no Indian office or partner verified. TechBag maps your endpoints and channels first, then quotes in INR with GST.
Endpoint Data Protection
Best for encryption and port control on its own
- Disk, folder, USB and cloud-folder encryption
- Device, port and application control
- Quoted; 30-day free trial
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Secure UEM bundle
Best for estates already on Matrix42 UEM
- EDP plus Unified Endpoint Management
- One Unified User Experience console
- Premium Services 24/7 support as an add-on
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Is the risk a lost device and a copied file, or a document sent outside? EDP handles the first; rights management the second.
Are your endpoints Windows? Ask Matrix42 in writing about any Macs, since no macOS disk encryption was documented.
EgoSecure Full Disk Encryption or the BitLocker Management module? The choice decides your exit path.
Which users need USB, Bluetooth, WiFi tethering or cloud storage, and should each be blocked or audited?
Where will the EgoSecure server and its SQL database run, and who in India administers and patches it?
Is there a pilot ring for Windows updates? Matrix42’s knowledge base logs boot problems after specific updates.
Can you live with European-hours support, or will a partner or Premium Services cover your shifts?
Does the quote state the licence unit, modules, term and any UEM bundle discount? Ask for INR with GST.
Questions buyers ask
Ready to evaluate Matrix42 Endpoint Data Protection?
Count your endpoints and the cost of handling USB requests and lost laptops first, or let a TechBag advisor place the server in India and run an audit-only pilot.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.