- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
CipherTrust Manager
Not whether the data is encrypted — who can decrypt it. CipherTrust Manager generates, stores, rotates and gates access to your keys, so the answer to an auditor is evidence rather than a contractual assurance. Virtual or hardware, and rootable in a Luna HSM.
Data residency & processing — two different questions
Where data lives
Yours — deploy on-premises in India
CipherTrust Manager deploys as a virtual appliance or physical hardware in your own data centre, and Luna HSM is a box you own. Keys, ciphertext and policy stay on infrastructure you control — the strongest position you can take on Indian residency, backed by the box’s serial number and its access log instead of a contract clause.
The constraint, stated plainly
No India SaaS region — and Noida is people, not data
CipherTrust as-a-Service runs in Europe and North America only. Thales has 2,200+ staff in India with Noida as its Cyber & Digital engineering centre, and that is a genuine commitment — but people in India and data in India are different facts. Offering that engineering footprint in reply to a residency question is the mistake an audit uncovers.
For a residency-bound Indian buyer this pushes you to on-premises deployment, which is very likely what your regulator wanted anyway. Under the DPDP Act the sequence matters more than the product: find the personal data first, then protect it. For RBI-regulated entities the question behind the question is usually who can decrypt, and whether administrators can read production data — both answerable here with evidence rather than assurance. And note what does not exist, so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant. No vendor in this category has a Gartner Leader placement, and any implying one is misleading you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Thales platform family
This page covers CipherTrust Manager — the key authority. The rest of the Thales data-security platform:
Quick facts
30-second orientation- Product
- CipherTrust Manager — the key authority
- What it does
- Generates, stores, rotates and gates access to keys
- Deployment
- Virtual appliance or physical hardware
- Root of trust
- Can be rooted in a Luna HSM — keys never in software
- Vendor
- Thales — Chairman & CEO Patrice Caine
- The cyber arm
- Thales Cloud Protection & Licensing
- Analyst standing
- KuppingerCole Overall Leader 2025 — Data Security Platforms
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- India engineering
- 2,200+ staff; Noida is the Cyber & Digital centre
- Data residency
- Yours — deploy on-premises or virtual in India
- Data processing
- On your infrastructure; CipherTrust SaaS is EU/NA only
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, key-custody scoping
Understand key management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
The central key-management authority for the CipherTrust platform — it generates, stores, rotates and controls access to cryptographic keys, and enforces who may use them.
Scattered key stores vs one key authority (CipherTrust Manager) — the honest table
What central key management actually changes, dimension by dimension.
| Dimension | Scattered key stores | CipherTrust Manager |
|---|---|---|
| Where keys live | Each cloud KMS, database and config file | One authority under your policy |
| Who can decrypt | Answered system by system | Answered from one audit trail |
| Rotation | Where it is easy | Scheduled per key, by policy |
| Cloud keys | Provider-generated, provider-held | BYOK or HYOK via Cloud Key Manager |
| Storage & VMware | A key store per product | One KMIP server |
| Root of trust | Software, wherever it landed | Software, or a Luna HSM |
| Separation of duties | Admins hold everything | Admin, officer and auditor roles |
| Best fit | One app needing encryption | Organisation-wide key custody |
CipherTrust Manager centralises key generation, rotation and access policy on infrastructure you run — virtual, physical, or rooted in a Luna HSM. CipherTrust as-a-Service has no India region. Thales publishes no list price; TechBag quotes in INR with GST.
The five pieces of CipherTrust Manager
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the key authority, demystified.
Virtual appliance
Runs on your own hypervisor or in a public cloud account you control. Enough for most buyers, and the form residency-bound Indian teams deploy in their own data centre.
Physical appliance
1U rack appliances. The k570 embeds a Luna PCIe HSM, so the master key is held in FIPS 140-2 Level 3 hardware inside the box rather than in software.
External root of trust
A virtual CipherTrust Manager can be rooted in a network HSM, giving hardware protection for the master key without buying a physical CipherTrust appliance.
Connectors
Everything that applies protection plugs in as a connector, each licensed separately, so one policy and one audit trail cover files, databases, applications and cloud keys.
Clusters & domains
Nodes cluster for availability, domains separate business units, and roles keep key administrators apart from security officers and auditors.
One authority decides who may use which key — and keeps the record that proves it.
Twelve capabilities. Keys, control, connectors.
What CipherTrust Manager actually does — runs the key lifecycle, controls who may use each key, and carries one policy to files, databases, clouds and KMIP clients through connectors.
Full Key Lifecycle
Generate, store, rotate, archive, revoke and destroy keys from one console, with versions kept so older data stays decryptable after rotation.
Rotation by Policy
Rotation runs on a schedule per key, so the blast radius of a compromised key is set by policy rather than by whoever remembers.
HSM-Rooted Key Hierarchy
Root the hierarchy in a Luna or supported third-party HSM, or buy the k570 with an HSM built in, so the master key never exists in software.
Post-Quantum Readiness
Thales positions CipherTrust Manager for post-quantum migration; confirm which algorithms your version supports before you plan around them.
Role-Based Access
Key administrators, security officers and auditors hold different roles — the separation a reviewer checks when asking who can decrypt.
Audit Trail of Key Use
Every key operation is logged with who, what and when, and can be forwarded to syslog or your SIEM as evidence.
Domains for Business Units
Separate domains let subsidiaries or business units manage their own keys in one installation without seeing each other’s.
FIPS 140-3 Security Profile
A recent release added a FIPS 140-3 cryptographic security profile that enforces approved algorithms across the core services.
KMIP Key Server
Serves keys over KMIP to storage arrays, databases and VMware encryption, so each product stops needing its own key store.
BYOK and HYOK for Clouds
CipherTrust Cloud Key Manager manages customer keys for AWS, Azure and Google Cloud from the same console.
REST APIs and SDKs
Pipelines and applications request keys and policy through APIs and SDKs instead of tickets and spreadsheets.
Free Community Edition
A free-forever Community Edition, with two enterprise connector licences, lets developers prove an integration before you buy.
Watch CipherTrust Manager in action
The overview, getting started, and the core workflows.
CipherTrust Data Security Platform — Overview
The platform, presented by Thales.
CipherTrust Data Security Platform Walkthrough
The console in use.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Encryption is the default. Custody is the question.
Here’s what genuinely sets CipherTrust Manager apart (and where a cloud KMS is enough).
It answers the question regulators actually ask
Cloud providers encrypt data at rest by default, which stops someone walking off with a disk but not the provider, who holds the key and can be served a lawful order without you. Indian regulators want proof a third party can’t decrypt your data; only key custody shows that, and CipherTrust Manager turns the promise into a demonstration.
One authority instead of scattered key stores
Without a key manager, keys end up in a dozen places: each cloud provider’s KMS, database encryption, a ‘temporary’ config file. Nobody knows who holds what, rotation happens where it is easy, and revoking access means finding every copy first. Centralising authority makes rotation a policy and the access question answerable in one place.
Rootable in hardware when the requirement demands it
CipherTrust Manager can run entirely in software under your control, which suffices for many buyers. Where keys must never exist in software — a regulator asking about hardware protection, payments or PKI, or a rule that a compromised host must not yield keys — it can be rooted in a Luna HSM, on the same platform.
The honest constraint: no India SaaS region
CipherTrust as-a-Service runs only in Europe and North America, with no India region. For residency-bound Indian buyers that points to on-premises or virtual deployment in your own data centre, a stronger custody position anyway. Thales’s 2,200+ India staff and Noida engineering centre are people, not a data region.
The honest positioning
CipherTrust Manager fits when key custody is the problem: a regulator has asked who can decrypt, or you are moving to cloud and want the key root in your building. For documents leaving the organisation you need rights management, such as Seclore or Microsoft Purview, and a single app needing encryption is often solved in the app itself.
The numbers behind the platform
What your CipherTrust Manager journey looks like
Decide the form and the root
Virtual, physical or HSM-rooted? The answer comes from your regulator and risk appetite, and it sets most of the cost.
Inventory every key store
List each cloud KMS, database encryption key and KMIP client in use today. That list becomes the migration backlog.
Design domains and roles
Map business units to domains and split administrators, security officers and auditors before anyone logs in.
Connect the first systems
Start with KMIP clients or one cloud’s BYOK, prove rotation end to end, then add connectors system by system.
Rotate, and review who uses keys
Keep rotation on schedule and review each quarter which identities use which keys; the audit log is your evidence.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Three cloud KMS consoles became one. The first audit where we could show every key’s owner took an afternoon, not a fortnight.”
“KMIP meant our storage arrays and VMware encryption used the same key server. That alone retired two separate key stores.”
“Get domains and roles right before go-live. We redesigned ours after launch, and untangling the permissions cost us a month.”
“We proved the API flow on the Community Edition first, then licensed connectors once the pilot held up under load.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the enterprise key-management market — tap any vendor to see why it sits where it does.
TechBag Key Management Grid
Execution strength vs product vision among enterprise key managers.
Broad connectors, HSM-rootable, KuppingerCole Overall Leader 2025.
Integration Breadth × Key Custody
How broadly a key manager integrates vs how firmly the customer holds the keys.
Wide integration, customer-held keys.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
CipherTrust Manager vs the key-management field
Entrust KeyControl, Fortanix DSM, HashiCorp Vault and the cloud providers’ own KMS — honest lanes. Cloud KMS is cheaper when provider custody is acceptable; Vault suits engineering-owned secrets; KeyControl is at home in VMware. We say so.
| Dimension | CipherTrust Manager | Entrust KeyControl | Fortanix DSM | HashiCorp Vault | Cloud KMS |
|---|---|---|---|---|---|
| What it is | Central key manager plus connectors | Key manager, at home in VMware | Key management and HSM, SaaS or on-prem | Secrets engine with encryption services | Each cloud provider’s own key service |
| Who holds the keys | You — virtual, physical or HSM-rooted | You — self-hosted | You on-prem, or Fortanix SaaS | You, when self-hosted | The provider, unless you add HYOK |
| Hardware root | Luna HSM, or k570 built-in | Can root in an HSM | FIPS-validated appliance option | HSM seal/auto-unseal (Enterprise) | Provider-run HSMs |
| KMIP server | Yes | Yes | Yes | KMIP engine (Enterprise) | No |
| India residency | Deploy in your own data centre | Self-host anywhere | Self-host, or check SaaS regions | Self-host anywhere | India regions exist; provider holds keys |
| Published pricing | Quote-only; free Community Edition | Quote-only | Quote-only | Free community; Enterprise by quote | Published per key and per request |
| The thing to plan around | Connector licences add up | Coverage outside VMware | Where the SaaS tenant runs | Operationally heavy to run well | Custody stays with the provider |
| Best fit | Organisation-wide custody across on-prem and cloud | VMware-centred estates | Teams wanting keys and HSM as a service | Engineering-owned secrets and encryption | Single-cloud workloads, provider custody accepted |
Which way of holding your keys fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose CipherTrust Manager if…
- ✓A regulator has asked who can decrypt, and you need one answer across systems
- ✓Keys for clouds, databases and storage should sit under one policy
- ✓You want the option to root it in a Luna HSM
- ✓Residency means running it in your own data centre
Entrust KeyControl if…
- ✓Most of what needs keys is VMware encryption and vSAN
Fortanix DSM if…
- ✓You want key management and HSM consumed as a service, and its region suits you
HashiCorp Vault if…
- ✓Engineering owns the problem and secrets matter more than enterprise key custody
Cloud KMS alone if…
- ✓Workloads sit in one cloud and provider custody is acceptable to your regulator
CipherTrust Manager is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (systems whose keys move under central management; loaded engineer-hour cost). The estimate contrasts keys scattered across cloud consoles, databases and config files — manual rotation, audit evidence gathered by hand — with one authority and one log. Illustrative — TechBag scopes your estate.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
CipherTrust Manager is quote-priced: the appliance (virtual k170v or k470v, physical k470 or k570) plus a licence for each connector you use. Thales publishes no list price, and a free Community Edition exists for testing. TechBag quotes in INR with GST.
Virtual appliance
Best for most residency-bound buyers
- k170v or k470v on your own infrastructure
- Optional external Luna HSM as the root of trust
- Connectors licensed per use case
Physical appliance
Best when hardware is expected
- k470 1U appliance, or k570 with an embedded Luna PCIe HSM
- Master key in FIPS 140-2 Level 3 hardware on the k570
- Clustered across sites for availability
+ TechBag scoping
Best value with TechBag
- Key-store inventory and migration order
- Domain and role design before go-live
- INR invoicing with GST, local support
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Must the master key sit in hardware — and if so, a k570 or an external Luna HSM?
Where will the cluster run, given the as-a-Service option has no India region?
Which existing key stores — cloud KMS, database encryption, KMIP clients — move first?
Which connectors do we need in year one, and how is each licensed?
Who are the key administrators, security officers and auditors, and are they different people?
BYOK or HYOK for each cloud, and which provider features does HYOK switch off?
How many cluster nodes, in which sites, and how are backups protected?
Can we produce, on demand, a report of who used which key and when?
Questions buyers ask
Ready to own the answer to who can decrypt?
Scope CipherTrust Manager with a TechBag advisor — virtual or physical, HSM-rooted or not, the connectors you need in year one and the domain and role design — compared honestly against Entrust KeyControl, Fortanix, Vault and cloud KMS, and quoted in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.