- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
CipherTrust Transparent Encryption
Encryption that does not require rewriting the application — an agent between the application and storage, so the fifteen-year-old system nobody will refactor becomes addressable. It also lets a DBA administer a system without reading the data inside it.
Data residency & processing — two different questions
Where data lives
Yours — deploy on-premises in India
CipherTrust Manager deploys as a virtual appliance or physical hardware in your own data centre, and Luna HSM is a box you own. Keys, ciphertext and policy stay on infrastructure you control — about as strong as an Indian residency answer gets, because you prove it with a serial number plus an access log, not contract wording.
The constraint, stated plainly
No India SaaS region — and Noida is people, not data
CipherTrust as-a-Service runs in Europe and North America only. Thales has 2,200+ staff in India with Noida as its Cyber & Digital engineering centre, and that is a genuine commitment — but people in India and data in India are different facts. Citing engineering headcount where residency is asked is the error auditors find.
For a residency-bound Indian buyer this pushes you to on-premises deployment, which is very likely what your regulator wanted anyway. Under the DPDP Act the sequence matters more than the product: find the personal data first, then protect it. For RBI-regulated entities the question behind the question is usually who can decrypt, and whether administrators can read production data — both answerable here with evidence rather than assurance. And note what does not exist, so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant. No vendor in this category has a Gartner Leader placement, and any implying one is misleading you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Thales platform family
This page covers CipherTrust Transparent Encryption — protection where the data sits. The rest of the Thales data-security platform:
Quick facts
30-second orientation- Product
- CipherTrust Transparent Encryption
- What it does
- Encrypts files and databases at rest, no app changes
- The other half
- Privileged-user access control — admin without reading
- Deployment
- Agent on the protected host
- Vendor
- Thales — Chairman & CEO Patrice Caine
- The cyber arm
- Thales Cloud Protection & Licensing
- Analyst standing
- KuppingerCole Overall Leader 2025 — Data Security Platforms
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- India engineering
- 2,200+ staff; Noida is the Cyber & Digital centre
- Data residency
- Yours — deploy on-premises or virtual in India
- Data processing
- On your infrastructure; CipherTrust SaaS is EU/NA only
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, key-custody scoping
Understand transparent encryption before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
An agent between the application and storage that encrypts data at rest and enforces access policy — with no modification to the application itself.
Disk or database-native encryption vs Transparent Encryption — the honest table
What an encryption agent with access policy actually adds, dimension by dimension.
| Dimension | Disk / database-native | Transparent Encryption |
|---|---|---|
| What is protected | A whole disk, or one database | Chosen files, folders and volumes |
| Who sees plaintext | Anyone the OS lets in | Only the processes and users the policy names |
| Root and DBA access | Full read of the data | Administer without reading |
| Legacy applications | Often left out of scope | Covered, with no code change |
| First encryption | A maintenance window per system | Live Data Transformation, in place |
| Keys | Stored with the system | Held in CipherTrust Manager |
| Access evidence | OS logs, if enabled | Allowed and denied logs to your SIEM |
| Best fit | A stolen-disk threat | Regulated data on systems you run |
Transparent Encryption encrypts files and volumes beneath the application and lets administrators work without reading the data. It protects data at rest on systems you run; a file exported by an authorised process is plaintext. Thales publishes no list price; TechBag quotes in INR with GST.
The five pieces of Transparent Encryption
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the agent and what surrounds it, demystified.
The agent
Installs on Windows, Linux or supported Unix hosts and encrypts on write, decrypts on read for authorised processes — the application above it is unchanged.
GuardPoints
Each protected directory or volume carries one policy stating which users and processes see plaintext, which see only ciphertext, and which are refused.
CipherTrust Manager
Agents take keys and policy from CipherTrust Manager, so rotation and revocation happen once, centrally, rather than host by host.
Live Data Transformation
An option that encrypts existing data and rotates keys while applications keep running, instead of a maintenance window for every system.
Access logging
Every allowed and denied access can be logged and sent to your SIEM, which turns ‘who read this?’ into a query rather than a guess.
The application is untouched; the policy decides which process sees plaintext.
Twelve capabilities. Encrypt, control, extend.
What Transparent Encryption actually does — encrypts beneath the application, controls which users and processes may read the result, and extends to containers, specific databases and ransomware detection.
File and Volume Encryption
Encrypts files and volumes at rest with AES, using FIPS 140-3 validated cryptography, beneath the application layer.
No Application Changes
Because the agent works at the file system, legacy applications and databases are protected without touching their code.
Live Data Transformation
Initial encryption and key rotation without taking data offline — often the difference between a pilot and a full rollout.
Amazon S3 and Azure Storage
Extends the same encryption and access policy to Amazon S3 and Azure storage used by your workloads.
Administer Without Reading
Root and DBA accounts keep running backups and maintenance while seeing only ciphertext.
Process-Level Access Rules
Allow the database engine to read plaintext while every other process, including admin shells, sees ciphertext.
LDAP and Active Directory
Policies use your existing LDAP and Active Directory users and groups, so access follows the identity model you already run.
Access Logs and Dashboards
Detailed allowed and denied access logs, prebuilt dashboards and SIEM integrations for alerting and evidence.
Ransomware Protection Option
A companion option watches process I/O for ransomware-like behaviour and can alert on it or block it.
CTE for Kubernetes
Protects persistent volumes with encryption, access control and access logging for containerised workloads.
SAP HANA and Teradata Variants
Database-specific versions built to protect those platforms while preserving their performance.
UserSpace for Linux
A user-space variant of the Linux agent, designed to keep working through routine server patching.
Watch Transparent Encryption in action
The overview, getting started, and the core workflows.
CipherTrust Transparent Encryption — Demo
Encrypting without changing the application.
CipherTrust Data Security Platform — Overview
Where it sits in the platform.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Disks get copied. Policy decides who reads.
Here’s what genuinely sets Transparent Encryption apart (and where built-in database encryption is enough).
It makes legacy systems addressable at all
The systems most in need of encryption are often ones nobody will modify: a fifteen-year-old, business-critical application whose authors are gone and whose vendor support ended. An agent between the application and storage protects the data on disk with the app unchanged, so the project can include the systems that matter most.
Administering a system without reading its data
In most estates, permission to run a database and permission to read every customer record in it are the same, by accident of how privileges work. Privileged-user access control separates them, so a DBA or root can do the job without reading data, the control RBI and SEBI reviewers probe when they ask who can access production data.
Policy enforced where the data is, not at the perimeter
Perimeter thinking assumes the boundary holds. Encrypting and enforcing access at the storage layer means a compromised network, a stolen backup or an over-permissioned account does not automatically yield readable data. The blast radius of any single failure shrinks, which is the practical security argument distinct from the compliance one.
The honest caveat: measure the overhead on your worst system
Encrypting and decrypting on every read and write costs performance, and how much depends entirely on your workload: I/O patterns, record sizes and how much data is hot. Abstract figures from a vendor or reseller mean little, so test on your oldest business-critical system during a proof of concept, not after rollout.
The honest positioning
This protects data at rest on infrastructure you control, including systems you can’t modify. It stops at that boundary: a file exported by an authorised process is plaintext elsewhere, which needs rights management such as Seclore or Microsoft Purview. It also needs CipherTrust Manager to decide who holds the keys.
The numbers behind the platform
What your Transparent Encryption journey looks like
Pick systems from a scan
Start from a discovery scan, not an inventory, and choose the directories and databases that hold regulated data.
Measure on the oldest system
Install the agent on your least-modern critical host and measure I/O overhead under real load before committing.
Write process-level policies
Name which processes may read plaintext. Test in learn mode first to see who touches the data before blocking anyone.
Encrypt in place
Use Live Data Transformation, where licensed, to encrypt existing data while the applications keep running.
Keep agents in the patch cycle
Check agent compatibility before each OS or kernel update, and review denied-access logs every week.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our DBAs still run the 2 a.m. backups. They just see ciphertext now, and the question of who reads production data has a clean answer.”
“Live Data Transformation let us encrypt a fourteen-year-old claims system without the weekend outage nobody would sign off.”
“Measure on your oldest box. The clean test host showed almost nothing; the ageing reporting server showed a real, if tolerable, hit.”
“Put agent upgrades on the OS patch calendar. We learnt that when a kernel update got ahead of the agent on a Friday night.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the data-at-rest encryption market — tap any vendor to see why it sits where it does.
TechBag At-Rest Encryption Grid
Execution strength vs product vision among ways to encrypt data at rest.
Agent-based encryption with privileged-user control.
Coverage × Insider Control
How much of the estate it covers vs how well it stops privileged users reading data.
Files, databases, containers, cloud storage — with admin control.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Transparent Encryption vs the at-rest encryption field
Database TDE, OS disk encryption, cloud providers’ default encryption and IBM Guardium Data Encryption — honest lanes. If a stolen disk is the only threat, built-in encryption is enough and cheaper. If administrators must not read the data, it is not. We say so.
| Dimension | Transparent Encryption | Database TDE | OS disk encryption | Cloud default encryption | IBM Guardium Data Encryption |
|---|---|---|---|---|---|
| What it is | File-system agent with access policy | Encryption built into Oracle, SQL Server and others | BitLocker, LUKS or dm-crypt volumes | At-rest encryption of cloud disks and buckets | Agent-based file and database encryption |
| Stops admins reading data | Yes — privileged-user access control | No — DBAs see plaintext | No — plaintext once mounted | No — admins and provider can read | Access policies — check privileged-user scope |
| Covers files outside databases | Yes | No — one engine only | Whole volume | Storage it hosts | Yes |
| Key custody | CipherTrust Manager, optionally HSM-rooted | Database wallet, unless an external KMS | TPM or local key | Provider, unless BYOK or HYOK | Its own central key manager |
| Access logging | Allowed and denied, to your SIEM | Database audit, configured separately | None at file level | Cloud audit logs | Logging — check the detail |
| Licence | Quote, typically per host | Oracle needs Advanced Security; SQL Server includes it | Included with the OS | Included | Quote |
| The thing to plan around | Measure overhead; keep agents in the patch cycle | One database engine at a time | Protects only a powered-off disk | Custody stays with the provider | Fit with your IBM estate |
| Best fit | Regulated data where admins must not read it | A single database with a stolen-media threat | Laptops and lost-disk risk | Baseline hygiene in the cloud | IBM Guardium estates |
Which way of encrypting data at rest fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Transparent Encryption if…
- ✓Administrators must be able to run systems without reading the data
- ✓The systems holding regulated data cannot be modified
- ✓You want one policy across files, databases and cloud storage
- ✓Keys should sit in CipherTrust Manager, not beside the data
Database TDE if…
- ✓One database holds the data and a stolen disk or backup is the real threat
OS disk encryption if…
- ✓The risk is a lost laptop or decommissioned drive, not an insider
Cloud default encryption if…
- ✓Provider custody is acceptable and nobody has asked who can decrypt
Rights management if…
- ✓The problem is documents leaving the organisation — see Seclore or Microsoft Purview
CipherTrust Transparent Encryption is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (hosts brought under encryption policy; loaded engineer-hour cost). The estimate contrasts per-system encryption projects — application changes, maintenance windows, access evidence gathered by hand — with one agent and one policy per host. Illustrative — TechBag scopes your estate.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Transparent Encryption is quote-priced, typically per protected host, with options such as Live Data Transformation and Ransomware Protection usually priced on top — and it needs CipherTrust Manager for keys and policy. Thales publishes no list price. TechBag quotes in INR with GST.
CTE agents
Best for files, folders and volumes
- Windows, Linux and supported Unix hosts
- Privileged-user access control and access logging
- Keys and policy from CipherTrust Manager
+ Options
Best for large or specialised estates
- Live Data Transformation for in-place encryption
- Kubernetes, SAP HANA and Teradata variants
- Ransomware Protection for abnormal I/O
+ TechBag scoping
Best value with TechBag
- Pilot on your least-modern critical host
- Policies tested in learn mode before enforcement
- INR invoicing with GST, local support
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which directories, volumes and databases hold regulated data — from a scan, not memory?
What overhead did we measure on our least-modern production-like host?
Which admin tasks must keep working, and which processes should see only ciphertext?
Do we need Live Data Transformation to avoid a maintenance window per system?
Are all our OS versions, kernels and databases on the supported list?
Who checks agent compatibility before each OS or kernel update?
Is CipherTrust Manager deployed and sized, and rooted in hardware if required?
Will denied-access logs reach our SIEM, and who reviews them?
Questions buyers ask
Ready to encrypt the systems nobody will rewrite?
Scope Transparent Encryption with a TechBag advisor — which hosts and directories, a performance pilot on your oldest system, process-level policies for administrators and whether you need Live Data Transformation — compared honestly against TDE and disk encryption, and quoted in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.