SailPoint
The identity governance category leader — ranked #1 by revenue in IGA by Gartner’s 2024 market-share research — running in the AWS Mumbai region since November 2024. This hub is your complete intel file, including the cost reality most buyers discover late: implementation typically runs 2–3× the licence.
Data residency & processing
SailPoint has run on AWS Asia Pacific (Mumbai) since 27 November 2024 — its ninth point of presence globally. SailPoint’s own words: a highly available multi-tenant SaaS environment “completely isolated from other AWS Regions—no data will be replicated, backed up, or stored in any other AWS Region.” That is the strongest documented India data-storage position of any IGA vendor we carry. It is a statement about STORAGE. SailPoint does not separately document where data is processed, and we are not going to infer it — if processing location is part of your obligation rather than storage, ask SailPoint directly and get it in writing.
On CERT-In: as the regulated entity you, not SailPoint, carry the 180-day ICT log obligation. CERT-In’s own FAQ permits storage outside India provided logs are producible to the authorities in reasonable time — but if you are IRDAI-regulated, the 2023 audit annexure asks as a plain yes/no whether ICT logs are stored in India, and that is where an offshore region actually costs you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Five intel pages. Identity governance, end to end.
SaaS and self-hosted IGA, contractor risk, data access and cloud entitlements — plus the capabilities folded in. Each intel page is a full decision file.
Identity Security Cloud
Who has access, should they, and can you prove it.
The flagship on SailPoint’s Atlas core: joiner-mover-leaver automation, certifications, role mining and SoD policy. Runs in AWS Mumbai.
IdentityIQ
The on-prem line, and the migration question.
On-premises, with a more flexible rules engine than the cloud. No announced end-of-life; migration typically takes two to three years.
Non-Employee Risk Management
Contractors, vendors and partners HR never sees.
Gives contractors, vendors and partners a lifecycle, an owner and an expiry. Integrated with Entra Verified ID since September 2025.
Data Access Security
Govern access to the data, not just the app.
Classifies sensitive data across cloud, on-prem and SaaS, finds over-privileged and externally shared access, and reviews data access.
Cloud Infrastructure Entitlement Management
Cloud entitlements, discovered and right-sized.
Discovers human and non-human identities across multi-cloud and right-sizes permissions toward least privilege with AI-driven insights.
Machine Identity Security
Platform layerDiscovery, classification and ownership of machine accounts — service accounts, bots, shared accounts
Access Risk Management
Platform layerSAP-focused access risk and segregation-of-duties analysis
Agentic Fabric
Platform layerSailPoint's framing for AI-agent identity — marketed as a fabric rather than sold as a discrete SKU
Harbor Pilot
Platform layerAI assistance across the platform
SailPoint is one of 22 identity governance products TechBag carries. The Identity & Access guide shows how the category splits and which part is yours. →
The two things buyers find out late
SailPoint genuinely leads this category — Gartner’s 2024 market-share research puts it #1 by revenue in IGA, and the AWS Mumbai region gives it the strongest documented India data-storage position of any vendor here. Two things are worth knowing before the sales cycle rather than during it. The licence is not your budget — third-party reporting puts implementation at two to three times licence cost, and below roughly a thousand identities the economics are hard to justify at all. And there is no Gartner Magic Quadrant for IGA, so any vendor claiming to lead one is misreading a document that does not exist in that form.
The Mumbai region, precisely
On AWS Asia Pacific (Mumbai) since 27 November 2024, isolated, with no data replicated, backed up or stored in other regions. That covers where data is STORED; processing is not documented.
Real category leadership
Gartner’s Market Share: Security Software, Worldwide 2024 ranks SailPoint first by IGA revenue. Not an MQ placement: the current research is a Market Guide (2 October 2025).
The early cost warning
Third-party reporting puts implementation at two to three times licence, the commonest buyer surprise. Below roughly a thousand identities the economics are hard to justify, and we say so.
IdentityIQ, not switched off
IdentityIQ has no announced end-of-life, its rules engine is more flexible, and migration typically takes two to three years in parallel. A free upgrade assessment exists; timing is yours.
Public, 88 percent controlled
Re-listed on the Nasdaq as SAIL in February 2025; FY2026 ARR was $1.125 billion, up 28 percent. Thoma Bravo kept roughly 88 percent, making SailPoint a controlled company.
Start where the pain is — cloud IGA or on-prem IdentityIQ — then extend to non-employees, data access and cloud entitlements.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
#1 by revenue in IGA
Market Share: Security Software, Worldwide 2024
SAIL — public again
Re-listed Feb 2025, $1.38B raised
AWS Mumbai region
9th point of presence — isolated, India-stored
$1.125B ARR, +28%
SaaS ARR $746M, +38%
India office since 2011
200+ staff as of 2023
~88% Thoma Bravo
A controlled company
2–3× licence
Typical implementation, third-party reported
No IGA MQ exists
It is a Market Guide — representative vendors
The company in six figures
See the platform, hear the pitch
SailPoint Identity Security Cloud Overview
The platform, introduced by SailPoint.
A guide to SailPoint Identity Security Cloud
A product-marketing walkthrough of the suites.
SailPoint Non-Employee Risk Management Overview
The contractor and partner blind spot.
Where SailPoint sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
SailPoint Across Its Portfolio
Each dot is a SailPoint product: competitive position vs category momentum.
The flagship platform on the Atlas core.
The Convergence Map
Who governs every human, machine and cloud identity in one platform — and who bolts governance onto another product.
Category leader by revenue. Documented Mumbai region. Enterprise-priced.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Which SailPoint product answers your problem?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What actually triggered this project?
2. Where does your identity estate live?
3. How big is the identity population?
What IGA actually is, and what it is not
Governance answers who has access, whether they should, and how you prove it. Provisioning only creates and removes accounts.
Read →Why the licence is not your budget
Implementation typically runs two to three times licence, so budget the programme, not the software.
Read →Storage, processing, and why they are different questions
SailPoint documents STORAGE in AWS Mumbai, not where data is PROCESSED. Find out which your compliance team means.
Read →Should you migrate off IdentityIQ?
No announced end-of-life, migration takes two to three years in parallel, and a free assessment exists. Decide by roadmap.
Read →The acronym decoder
Every term on these pages, in one place- IGA
- Identity governance and administration — who has access to what, should they, and can you prove it.
- JML
- Joiner-mover-leaver — automating access as people arrive, change role and leave. Provisioning, not governance.
- Certification
- An access review campaign: managers or owners confirm that the access their people hold is still appropriate.
- Attestation
- The evidence produced by a certification — the artefact an auditor asks for.
- SoD
- Segregation of duties — rules preventing one person holding combinations of access that enable fraud.
- Role mining
- Deriving roles from actual entitlement data rather than designing them on a whiteboard first.
- Entitlement
- A specific permission inside an application — the granular unit governance actually reviews.
- Non-employee identity
- Contractors, vendors and partners — identities the HR system does not own, and the usual audit gap.
- CIEM
- Cloud infrastructure entitlement management — governing permissions across cloud platforms.
- Atlas
- SailPoint's name for the core the Identity Security Cloud platform is built on.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Decide what your obligation actually says
Is it an access review to evidence or slow provisioning? And does compliance mean STORAGE or PROCESSING? SailPoint documents Mumbai storage, not processing.
Size it honestly, then budget for the programme
Below roughly a thousand identities enterprise IGA is hard to justify. Above it, budget implementation at two to three times licence, not the licence alone.
Scope the connectors before anything else
List every application to govern, mark which have supported connectors and which need custom work, and price it. That predicts your timeline best.
Get the Mumbai region confirmed in writing
Put the AWS Asia Pacific (Mumbai) region and the sub-processor list in the contract. If IRDAI-regulated, ask the processing question explicitly.
Compare against Saviynt, and against doing less
Saviynt is the main bake-off rival, with the larger India engineering presence; if you need joiner-mover-leaver, not certification, a lighter tool may win.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Identity Security Cloud | Per identity, QUOTE-ONLY | No published rate card | Certification, SoD and audit evidence |
| The real cost | Services, not licence | Implementation commonly 2–3× licence | Budget the programme, not the software |
| Navigators (Dec 2025) | Digital Identity Flex · Premier Flex | Shift allocation between machine and agent identities | Still quote-based |
| IdentityIQ | On-premises licensing | Quote-only; no announced end-of-life | Complex legacy estates, rules engine |
| Minimum viable size | Not a published floor | Below ~1,000 identities the economics are hard | We will tell you when it does not fit |
Per-device and per-user pricing across the trio — TechBag negotiates the converged bundle against the vendors you’ll retire.
Five pitfalls that cost buyers quarters
Budgeting the licence and forgetting the programme
The most frequent and costliest error. Implementation typically runs two to three times licence; connectors, role modelling and certification design are real work that thin proposals skip.
Buying governance when you needed provisioning
If new joiners wait a week for access, cheaper joiner-mover-leaver automation fixes that. Governance earns its cost when you must prove access is appropriate. Know which you need.
Assuming the Mumbai region answers a processing question
SailPoint documents replication, backup and storage, not processing location. Storage suffices for most buyers, but IRDAI-regulated insurers face a direct audit question. Ask explicitly.
Believing IdentityIQ is about to be switched off
There is no announced end-of-life, and migrations take two to three years with both platforms running in parallel. Treat a migration as a roadmap decision you time, not a deadline someone else set for you.
Reading '#1 in IGA' as a Magic Quadrant position
SailPoint is first by revenue in Gartner’s 2024 market-share research. That is not an MQ Leader slot: Gartner has no IGA Magic Quadrant, only a Market Guide. Keep the business case precise.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your device counts and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Five trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: the identities growing fastest are the ones nobody governs — machines, workloads and contractors — which is where SailPoint has aimed its last two years of product work.
Taken private by Thoma Bravo
~$6.9 billion, three years after its 2017 IPO.
What it means for you
Private equity funded the cloud shift; Thoma Bravo still holds ~88%, so ownership still matters.
Re-listed on the Nasdaq as SAIL
$23 per share, raising $1.38 billion.
What it means for you
Public filings let you check its ARR, which you cannot do for Saviynt or Omada.
AWS Mumbai region goes live
SailPoint's ninth point of presence globally.
What it means for you
The strongest documented India storage of any IGA vendor we carry, isolated from other AWS regions.
Machine and non-employee identity deepen
Entra Verified ID integration; machine account sub-types.
What it means for you
Contractors, service accounts and bots now outnumber staff in most estates and are governed least.
$1.125B ARR, up 28%
SaaS ARR $746M (+38%); customers above $1M ARR up 62%.
What it means for you
Growth is in large customers, which shows where the product fits and where it does not.
Questions buyers ask about SailPoint
Ready to shortlist SailPoint?
Open a product intel page for the deep dive, or bring your device and user counts and let a TechBag advisor build the converged case with you — quotes, trials, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.