Entrust nShield HSM
Keys generated inside the appliance that never leave in usable form, managed across appliances by Entrust’s Security World. BIS registration is a mandatory safety gate that nShield and Thales Luna both clear — so the comparison turns on architecture, portfolio and analyst standing, not on BIS.
Data residency & processing — two different questions
Where data lives
Yours — on-premises appliances in India
nShield HSMs are physical appliances in your own data centre, and private PKI can run on-premises too. Keys are generated and held in hardware you own, in India, under your administrators — the proof is physical: the unit’s serial number with its access log, not contract language.
The constraint, stated plainly
No India region for the managed service
nShield as a Service runs in the UK, US, Germany and Australia. Entrust has live engineering hiring in Bengaluru and Pune, and that is people in India, not data in India — mistaking engineering headcount for a residency answer is the slip auditors catch.
For a residency-bound Indian buyer the answer is appliances you operate, which is very likely what your regulator wanted anyway. Note what does not exist so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant — and we could not verify an HSM Leader placement for Entrust with any analyst. A search caution specific to this vendor: “Entrust India” surfaces several unrelated companies, including a Bengaluru wealth manager, so check you are reading about Entrust Corporation before drawing conclusions.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Entrust portfolio
This page covers Entrust nShield HSM — hardware key custody. The rest of the Entrust portfolio on TechBag:
Quick facts
30-second orientation- Product
- Entrust nShield HSM
- BIS (India)
- IS 13252 safety registration — Connect XC since 2019
- What BIS is
- A mandatory safety gate — Thales Luna holds it too
- Current models
- nShield 5c (network) and 5s (PCIe) — succeed Connect XC / Solo XC
- Certification
- nShield 5: FIPS 140-3 Level 3, Common Criteria EAL4+
- Architecture
- Security World — keys across a group of HSMs
- Vendor
- Entrust — CEO Tony Ball, from 31 March 2026
- Ownership
- Private, via Datacard — Germany's Quandt family
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- Analyst standing
- No HSM/key-management Leader placement verified
- Client licences
- Network appliances include three; more are extra
- Data residency
- On-premises; nShield as a Service has no India region
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, BIS scoping
Understand hardware key custody before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
A hardware security module: a certified, tamper-resistant device in which keys are created, stored and used — applications send it data to sign or decrypt and get results back, never the key.
Software-held keys vs keys in an HSM — the honest table
What moving keys into hardware changes, dimension by dimension.
| Dimension | Software-held keys | nShield HSM |
|---|---|---|
| Where the key lives | In host memory or a key file | Inside a certified module |
| Compromised server | Can yield the key | Can request operations, not the key |
| Key backup | Copies on disks and in scripts | Encrypted under the Security World |
| Who can use a key | Whoever can read the file | Card-set quorum you define |
| Second site | Copy the key across | Enrol a second HSM in the World |
| Audit evidence | Configuration screenshots | Certified hardware and access logs |
| Indian tender requiring BIS | No appliance to register | Registered appliance — confirm by model |
| Cost | Low, mostly effort | Appliance, support and operations |
An HSM protects keys, not data on its own — it sits under your PKI, databases and signing systems. Software key management under your control is often enough, and TechBag will say so when it is.
The five pieces of an nShield deployment
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Certified Module
A FIPS 140-3 Level 3 module (nShield 5 family) generates keys inside the device and performs signing and decryption there, so keys never sit in host memory.
Security World
Application keys are stored encrypted under the Security World key, so any HSM enrolled in the same World can use them — the basis for load-sharing, failover and DR.
Card Sets & Quorum
Administrator and Operator Card Sets with K-of-N quorums decide who can recover the World or load a key — separation of duties enforced by the hardware.
Client APIs
Applications call the HSM through PKCS#11, Java JCE or Microsoft CNG; each host connecting to a network appliance uses a client licence, three included by default.
Form Factors
The nShield 5c network appliance, the nShield 5s PCIe card, or nShield as a Service from Entrust data centres — the same Security World model across all three.
Keys stay inside certified hardware; the Security World decides which HSMs may use them, and the card sets decide who may.
Twelve capabilities. Protect, operate, prove.
What nShield actually does — keys created and used inside certified hardware, shared across HSMs through the Security World, and evidenced for auditors and tenders.
Keys Born in Hardware
Keys come from the module’s certified random number generator and never leave in plaintext: hardware key protection.
FIPS 140-3 Level 3
The nShield 5 family is certified to FIPS 140-3 Level 3, announced by Entrust in August 2024 — the standard most HSM tenders reference.
Common Criteria EAL4+ and eIDAS
nShield 5 HSMs hold Common Criteria EAL4+ certification, which is what EU eIDAS qualified-signature and seal services look for in a signing device.
BIS Safety Registration
BIS registration under IS 13252, a mandatory safety standard, covers nShield Connect XC since 2019; ask for the 5c certificate.
One Key Domain Across HSMs
Keys encrypted under the Security World can be used by every enrolled HSM, so adding capacity or a second site does not mean moving key material by hand.
Load-Sharing and Failover
Several HSMs in one Security World serve the same keys, so applications keep signing when one unit fails or is taken down for a firmware update.
K-of-N Quorum Control
Recovery and use of the most sensitive keys can require several card holders at once, so no single administrator can act alone on them.
Run Code Inside the Boundary
CodeSafe lets custom application logic execute inside the HSM’s protected environment, for cases where the key is not the only thing worth protecting.
Published Integration Guides
Entrust publishes nShield integration guides for certificate authorities, including its own and Microsoft AD CS, plus databases and signing tools.
Tamper-Resistant, Tamper-Evident
A hardened enclosure resists and reveals physical tampering, and administrative actions are logged — evidence an auditor can inspect directly.
A Firmware Path to Post-Quantum
The nShield 5 processor is crypto-agile and firmware-upgradable; confirm which firmware release supports the post-quantum algorithms you need.
nShield as a Service
Dedicated nShield HSMs hosted by Entrust in the UK, US, Germany and Australia; for Indian residency, use the appliance.
Watch Entrust nShield HSM in action
The appliance, and the category it belongs to, from Entrust’s own channel.
Entrust nShield HSMs: On Another Level
The appliance, presented by Entrust.
What is a hardware security module (HSM)?
The category, explained.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Hosts get compromised. Keys should not.
Here’s what genuinely sets nShield apart.
BIS registration is a gate for every HSM, not a differentiator
BIS registration under IS 13252 is a mandatory IT-equipment safety standard, not a security certification. nShield Connect XC was registered in 2019 and Thales lists BIS for Luna, so it won’t separate them. Registration is by model: get the certificate naming your exact appliance, as the nShield 5c is unconfirmed.
Keys that cannot be extracted, by construction
Software key management can be excellent, but its keys sit in host memory, and a badly compromised host can yield them. An HSM generates and uses keys inside the appliance, so they never leave in usable form; compromising the calling server lets an attacker request operations, not take the key.
Security World makes resilience an architecture, not a retrofit
Entrust’s Security World manages a group of HSMs as one logical unit, so a second appliance at another site is a design choice made at the start, not a painful key migration later, and disaster recovery has a defined shape. It is a genuine architectural difference from Luna.
The honest cost: an appliance, not software
HSM budgets usually capture the hardware and miss the rest: support, firmware maintenance, Security World backup, new separation-of-duties roles, and a second unit and site to survive a data-centre failure. None of it is exotic, all of it is real, and it is better costed now.
The honest positioning
Buy nShield when hardware key custody is required and Security World suits you, or when Entrust PKI or identity is in your plan. Choose Thales for the stronger analyst position or broader software platform. BIS won’t decide it. And if software key management under your control would do, choose neither.
The numbers behind Entrust
What your nShield HSM journey looks like
Name what actually decides it
BIS is a safety gate both nShield and Thales Luna clear; decide on Security World fit, portfolio, analyst standing and price.
Match the model to the certificate
BIS registered nShield Connect XC in 2019; the 5c is unconfirmed, so get the certificate for your exact model before bidding.
Decide whether hardware is genuinely required
Software key control often suffices; hardware is needed when a regulator, a payments or PKI use case, or your risk review demands it.
Design Security World and the second appliance
Design the Security World for resilience now, and budget a second appliance, site and network link rather than retrofitting later.
Test the Security World restore
Back up the Security World and test a restore; an untested backup of a hardware key domain is a dangerous assumption.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“BIS registration was in the tender. Both shortlisted HSMs had it, so the Security World design decided it.”
“Moving our issuing CA keys onto the HSM took a weekend. Agreeing who holds the operator cards took a month.”
“Security World meant the second site was a design decision rather than a migration.”
“Budget the operations, not the appliance. The separation of duties took longer than the install.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the encryption and key-custody market — tap any vendor to see why it sits where it does.
TechBag Key-Custody Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Security World resilience; BIS-registered, like its peer.
Platform Breadth × Key Custody
How broad the software platform is vs how deep the hardware key custody goes.
Deepest on hardware custody; a lighter software platform around it.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Entrust nShield vs the key-custody field
Thales, Microsoft Purview, Seclore and HashiCorp Vault — honest lanes; the edge is certified hardware custody and Security World resilience; BIS registration is a gate both nShield and Luna clear.
| Dimension | Entrust | Thales | Microsoft Purview | Seclore | HashiCorp Vault |
|---|---|---|---|---|---|
| What it actually is | Network and PCIe HSMs, plus a hosted service | Key management, HSM and encryption platform | Document rights management | India-built EDRM | Secrets and encryption-as-a-service |
| BIS registration (India) | Connect XC registered (IS 13252, 2019); confirm the 5c | Luna Network HSM brief lists India BIS (IS 13252) | Not applicable | Not applicable | Not applicable |
| Hardware key custody | nShield, with Security World | Luna HSM | DKE holds one key; not an HSM product | Not an HSM vendor | Can integrate with an HSM |
| Verified analyst standing | None verified for HSM or key management | KuppingerCole Overall Leader 2025 ×2 | Microsoft, evaluated broadly elsewhere | Specialist — no Gartner EDRM MQ exists | Widely recognised in its category |
| Public TLS certificates | SOLD to Sectigo, Sept 2025 — no longer offered | Not a public CA | Not a public CA | Not a public CA | Not a public CA |
| India data residency | On-premises appliances — no India SaaS region | On-premises — no India SaaS region | India region via Advanced Data Residency | India-built; SaaS or self-hosted | Self-host anywhere, including India |
| Published pricing | Quote-only | Quote-only | $12/user/mo Purview add-on; E5 $60 | Quote (INR) | Free community edition |
| The thing to plan around | Confirm BIS covers the model you buy (5c vs Connect XC) | HSM operations: firmware, backup, separation of duties | DKE breaks co-authoring, search and Copilot | Adoption — manual protection is rarely applied | Operationally heavy to run well |
| Best fit | Security World resilience; Entrust PKI on the same hardware | Key custody with the broader software platform | Microsoft estates with E5 needing document labels | Documents shared outside, India-built vendor | Engineering-owned secrets and encryption services |
Which key-custody approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Entrust nShield if…
- ✓You want one vendor for HSM, PKI and identity
- ✓Keys must never exist in software
- ✓You want Security World resilience across sites
- ✓You will also root Entrust PKI in the same hardware
Thales Luna if…
- ✓You want the stronger verified analyst position and CipherTrust
HashiCorp Vault if…
- ✓Engineers own secrets and software key custody is enough
A cloud provider’s HSM if…
- ✓Workloads live in one cloud and its HSM service meets your residency rule
No HSM if…
- ✓No regulator, mandate or risk finding requires hardware keys
Entrust nShield HSM is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (keys you handle by hand today; loaded engineer-hour cost). Estimates assume the rotation, backup and audit-evidence effort removed once keys live in a managed Security World — the larger, unpriced value is a key that cannot be extracted from a compromised host. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Entrust nShield is quote-priced (no public list) — by model (nShield 5c appliance, nShield 5s card or nShield as a Service), client licences, options such as CodeSafe, and support term. Budget the second unit and the operations too. TechBag right-sizes it and quotes in INR with GST.
nShield 5c
Best for a shared data-centre appliance
- Network-attached HSM for several applications
- FIPS 140-3 Level 3; three client licences included
- Pair a second unit for failover
nShield 5s
Best when one server needs an HSM inside it
- PCIe card installed in the host
- Same Security World model as the appliance
- Keys stay inside the card, not the server
nShield as a Service
Best outside India, without hardware to run
- Dedicated HSMs in Entrust data centres
- UK, US, Germany and Australia — no India region
- You keep control of the Security World
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every vendor
Take this into your next vendor call — including ours.
Does our tender require BIS registration (IS 13252) — and does every shortlisted HSM model hold it?
Does the BIS certificate name the exact nShield model we are buying — Connect XC or the newer 5c?
Do keys genuinely need to exist only in hardware, or would software key management under our control do?
Have we designed the key domain, and do we have a second appliance for resilience?
Who administers the appliance, and who approves key use? They must be different people.
Have we backed up the Security World AND tested restoring from it?
Are we deploying on-premises? nShield as a Service has no India region.
How many application hosts will connect? A network appliance includes three client licences; more cost extra.
Have we avoided implying a Gartner Leader placement? No MQ exists for this category.
Have we budgeted support, firmware, backup discipline and the second unit — not just the appliance?
Questions buyers ask
Ready to put your keys in hardware?
Confirm BIS registration for the exact model, size the appliances and the second site, or let a TechBag advisor cost the whole HSM programme with you.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.