- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
CipherTrust Secrets Management
The credentials your applications use, held properly — API keys, database passwords, certificates and tokens out of config files, environment variables and source control. KuppingerCole Overall Leader 2025 for Enterprise Secrets Management.
Data residency & processing — two different questions
Where data lives
Akeyless SaaS — with your fragment on-premises
Secrets are stored by the Akeyless Vault Platform, delivered as SaaS. The customer fragment that completes their encryption sits on your CipherTrust Manager, in your data centre, under its root of trust — which Akeyless says keeps secrets unreadable to the provider.
The constraint, stated plainly
No India storage region documented — confirm it
We found no published statement of an India storage region for the SaaS core. Ask Thales to confirm your tenant’s storage region in writing before moving regulated credentials. Thales’s 2,200+ staff in India are people, not a data region.
For a residency-bound Indian buyer the question is what the SaaS core holds — encrypted secrets it cannot open without your fragment — and whether your regulator accepts that. If it does not, a self-hosted secrets manager is the alternative, and TechBag sells HashiCorp Vault. The gateway also needs outbound connectivity to Akeyless, so involve your network team early. Under the DPDP Act and RBI outsourcing directions, write down who can read what, and where, before you migrate.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Thales platform family
This page covers CipherTrust Secrets Management — machine credentials. The rest of the Thales data-security platform:
Quick facts
30-second orientation- Product
- CipherTrust Secrets Management
- What it holds
- API keys, database passwords, certificates, tokens
- Analyst
- KuppingerCole Overall Leader 2025 — Enterprise Secrets Management
- The alternative
- HashiCorp Vault — TechBag sells both; see the FAQ
- Vendor
- Thales — Chairman & CEO Patrice Caine
- The cyber arm
- Thales Cloud Protection & Licensing
- Analyst standing
- KuppingerCole Overall Leader 2025 — Data Security Platforms
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- India engineering
- 2,200+ staff; Noida is the Cyber & Digital centre
- Data residency
- No India storage region documented — confirm in writing
- Delivery
- Akeyless SaaS core; your fragment on CipherTrust Manager
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, key-custody scoping
Understand secrets management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Centralised management of the credentials applications use — API keys, database passwords, certificates and tokens — issued, scoped and rotated under one authority.
Secrets in config and repos vs CipherTrust Secrets Management — the honest table
What a secrets vault actually changes, dimension by dimension.
| Dimension | Secrets in config and repos | Secrets Management |
|---|---|---|
| Where secrets live | Config files, env vars, repositories | One vault, fetched at runtime |
| Lifetime | Years, never rotated | Rotated on schedule, or dynamic |
| Who knows them | Every team that ever deployed | Only workloads a policy allows |
| After a leak | Hunt down every copy | Rotate once, centrally |
| Certificates | Expiry found by an outage | Tracked and renewed |
| Audit | None | Every read logged |
| Custody | Whoever has the repository | Your fragment on CipherTrust Manager |
| Best fit | Nobody’s choice | Security-team-owned machine credentials |
CipherTrust Secrets Management is powered by Akeyless: a SaaS core, a gateway on your CipherTrust Manager, and your fragment of the encryption held there. Confirm the storage region in writing. Thales publishes no list price; TechBag quotes in INR with GST.
The five pieces of CipherTrust Secrets Management
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the SaaS core and your side of it, demystified.
Akeyless SaaS core
Secrets are stored and served by the Akeyless Vault Platform, delivered as SaaS; Thales sells and integrates it as CipherTrust Secrets Management.
The gateway
A gateway service running on CipherTrust Manager handles sign-in to the SaaS core, and needs outbound network access to Akeyless to work.
Customer fragment
Encryption is split into fragments; yours sits on CipherTrust Manager under its root of trust, which Akeyless says keeps secrets unreadable to the provider.
Secret types
Holds static secrets, rotates passwords and keys, issues short-lived dynamic credentials and manages the machine-certificate lifecycle.
Integrations
Plugins and APIs for Kubernetes, OpenShift, GitHub and CI/CD pipelines deliver secrets at runtime instead of leaving them in config files.
Secrets fetched at runtime, rotated on schedule, and never sitting in a repository again.
Twelve capabilities. Store, rotate, deliver.
What CipherTrust Secrets Management actually does — holds credentials in one vault with your fragment on-premises, rotates or issues them on demand, and delivers them to pipelines and workloads at runtime.
One Home for Secrets
API keys, passwords, tokens and certificates held in one service instead of config files, environment variables and repositories.
Customer-Held Fragment
Distributed Fragments Cryptography with your fragment on CipherTrust Manager, so the SaaS provider cannot assemble the key alone, per Akeyless.
Governance Across Vaults
Thales describes visibility and governance across multiple secrets vaults, for estates already running more than one.
Access Policy and Audit Log
Role-based access and a log of who read which secret, as evidence for SOC 2, ISO 27001 and PCI DSS reviews.
Automated Rotation
Rotates passwords, API keys, database credentials and certificates on schedule, with no manual steps.
Just-in-Time Credentials
Issues short-lived credentials on request that expire after use, so a leaked credential is worth little.
Certificate Lifecycle
Discovery, issuance, renewal, rotation, revocation and expiry monitoring for machine certificates.
Shared Password Rotation
Rotation for service-account and shared passwords that people still need to use.
Kubernetes and OpenShift
Secrets injected into workloads at runtime rather than baked into images or manifests.
Pipelines and GitHub
Pipelines fetch credentials when they run, so build logs and repositories stop carrying them.
Credentials for AI Pipelines
Thales positions it for credentials used by LLM applications, agentic AI workflows and ML pipelines.
Beside Your Keys
Secrets appear as a tile in the CipherTrust Manager console, next to key management.
Watch CipherTrust Secrets Management in action
The overview, getting started, and the core workflows.
CipherTrust Data Security Platform — Overview
Where secrets management sits.
CipherTrust Data Security Platform Walkthrough
The platform in use.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Credentials leak. Short-lived ones matter less.
Here’s what genuinely sets CipherTrust Secrets Management apart (and where HashiCorp Vault fits better).
Credentials in config files are a reliably exploited vector
Without secrets management, credentials live in config files, environment variables, pipelines and source control, and leaked repository credentials are among attackers’ most dependable ways in. Those credentials are long-lived, shared and never rotated, so one leak stays valid indefinitely; central issue and rotation bounds the exposure.
Machine identity is now most of your identity problem
Human accounts get privileged access management, joiner-mover-leaver processes and access reviews, while machine credentials, which vastly outnumber them, often get a wiki page. As automation grows, the broadest-access credentials are often ones nobody has reviewed; managing them centrally gives machines the governance people already get.
Secrets and keys under one authority
Inside the CipherTrust platform, machine credentials and cryptographic keys share one system, audit trail and policy model. A separate secrets tool beside a key manager creates two inventories that drift apart, so answering who could reach what means reconciling both. KuppingerCole rated Thales an Overall Leader here in 2025.
The honest comparison: HashiCorp Vault
TechBag sells Vault too. It has deeper developer adoption, strong dynamic secrets and a free community edition, but it is operationally heavy, with unseal, replication and upgrades teams underestimate. CipherTrust Secrets Management is lighter and coherent with your key management; ownership usually decides, and neither answer is wrong.
The honest positioning
Choose this if you already run CipherTrust and want secrets under the same authority as keys, owned by security. Choose Vault if engineering owns it and dynamic credentials are central. If the real problem is human privileged access, that is PAM, and TechBag sells CyberArk and Arcon for it.
The numbers behind the platform
What your CipherTrust Secrets Management journey looks like
Decide who owns it
Security team or platform team? Ownership usually decides between this and Vault more than any feature does.
Find the secrets first
Scan repositories, pipelines and config for hard-coded credentials; DDC’s secrets discovery helps in files.
Connect gateway and fragment
Enable the gateway on CipherTrust Manager, open outbound access to the SaaS core, and set up your fragment.
Migrate the worst offenders
Start with shared, long-lived database and cloud credentials, and move them to rotated or dynamic secrets.
Rotate, and review readers
Keep rotation schedules running and review each quarter which workloads read which secrets.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Moving pipeline credentials out of Jenkins variables took one sprint. Rotating them used to take a change request each time.”
“Security wanted secrets beside the key manager; engineering wanted Vault. At our size, one console for both settled it.”
“Check outbound connectivity early. The gateway’s firewall rule to the SaaS core took us three weeks to get approved.”
“Dynamic database credentials ended the one shared app password that eight services and two contractors all knew.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the enterprise secrets-management market — tap any vendor to see why it sits where it does.
TechBag Secrets Management Grid
Execution strength vs product vision among secrets-management tools.
Akeyless engine inside the key-management platform; KC Overall Leader 2025.
Developer Reach × Customer Custody
How far it reaches into pipelines and platforms vs how much custody the customer keeps.
Broad integrations; your fragment on-premises.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
CipherTrust Secrets Management vs the secrets-management field
HashiCorp Vault, Akeyless direct, AWS Secrets Manager and CyberArk Conjur — honest lanes. Vault suits teams that self-host everything; AWS Secrets Manager is simplest inside AWS; Conjur fits CyberArk estates. We sell Vault too, and we say so.
| Dimension | CipherTrust Secrets Management | HashiCorp Vault | Akeyless (direct) | AWS Secrets Manager | CyberArk Conjur |
|---|---|---|---|---|---|
| What it is | Akeyless engine, sold and integrated by Thales | Secrets engine, self-hosted or HCP | The same SaaS platform, bought direct | Secrets service inside AWS | Secrets management from a PAM vendor |
| Delivery | SaaS core, gateway on your CipherTrust Manager | Self-host anywhere, or managed HCP | SaaS core, gateway you run | AWS-managed, per region | Self-hosted or SaaS |
| Dynamic secrets | Yes | Yes — a core strength | Yes | Rotation via Lambda functions | Check the credential types you need |
| Keys and secrets together | Same console as CipherTrust keys | Transit engine for encryption | Own key features, separate from CipherTrust | Pairs with AWS KMS | Pairs with CyberArk PAM |
| India residency | No India storage region documented | Self-host in India | Confirm region with the vendor | Mumbai and Hyderabad regions | Self-hosted option |
| Published pricing | Quote-only | Free community; Enterprise by quote | Check current plans | $0.40 per secret a month plus API calls | Quote |
| The thing to plan around | Outbound link to the Akeyless SaaS core | Running it well is real work | No CipherTrust tie-in | Reach beyond AWS | Best inside a CyberArk estate |
| Best fit | Security teams already on CipherTrust | Platform teams that run their own infrastructure | Buyers wanting the engine without Thales | Workloads entirely in AWS | Organisations standardised on CyberArk |
Which way of managing machine credentials fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose CipherTrust Secrets Management if…
- ✓You run or are buying CipherTrust Manager
- ✓A security team will own machine credentials
- ✓You want secrets and keys in one console and audit trail
- ✓A SaaS core with your fragment on-premises is acceptable
HashiCorp Vault if…
- ✓A platform-engineering team owns it and wants to self-host everything
AWS Secrets Manager if…
- ✓Every workload that needs the secrets runs inside AWS
CyberArk Conjur if…
- ✓You have standardised on CyberArk for privileged access
A PAM tool instead if…
- ✓The real problem is people with admin access, not machine credentials
What could this save you?
Drag the sliders (applications and pipelines that use secrets; loaded engineer-hour cost). The estimate contrasts credentials kept in config and rotated by hand — change requests, outages from expired certificates, leak clean-ups — with a vault that rotates on schedule. Illustrative — TechBag scopes your estate.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
CipherTrust Secrets Management is quote-priced, with a 90-day free trial; it runs alongside CipherTrust Manager, which hosts the gateway and your fragment. Thales publishes no list price. TechBag quotes in INR with GST.
Secrets Management
Best for security-team-owned secrets
- Akeyless-powered vault with your fragment on-premises
- Rotation, dynamic secrets and certificate lifecycle
- Quote-only, with a 90-day free trial
+ CipherTrust Manager
Best for keys and secrets together
- Hosts the gateway and your customer fragment
- One console for keys and secrets
- Root of trust, optionally in a Luna HSM
+ TechBag scoping
Best value with TechBag
- Ownership and Vault comparison settled first
- Gateway network path and residency confirmed
- INR invoicing with GST, local support
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Will a security team or a platform team own secrets — and does that point here or to Vault?
Are we comfortable with a SaaS core, given our fragment stays on CipherTrust Manager?
Has the vendor confirmed in writing where our tenant’s secret data is stored?
Can the gateway reach the Akeyless SaaS core through our firewall and proxy rules?
Do we know where hard-coded credentials sit today — repositories, pipelines, config files?
Which credentials become dynamic, which get rotated, and which stay static?
Is our problem machine credentials, or human privileged access that needs PAM?
How would we export our secrets if we left the platform?
Questions buyers ask
Ready to get credentials out of your repositories?
Scope CipherTrust Secrets Management with a TechBag advisor — who owns it, where your secret data is stored, the gateway’s network path and which credentials go dynamic first — compared honestly against HashiCorp Vault and AWS Secrets Manager, and quoted in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.