SailPoint Identity Security Cloud
Identity Security Cloud answers the three questions an auditor asks — who has access, should they, and can you prove it — with certification campaigns, SoD policy and an evidence trail. From the #1 vendor by revenue in IGA, running in AWS Mumbai since November 2024.
Data residency & processing
SailPoint has run on AWS Asia Pacific (Mumbai) since 27 November 2024 — its ninth point of presence globally. SailPoint’s own words: an environment“completely isolated from other AWS Regions—no data will be replicated, backed up, or stored in any other AWS Region.” That is the strongest documented India data-storage position of any IGA vendor we carry. It is a statement about STORAGE. SailPoint does not separately document where data is processed, and we are not going to infer it — if processing location is part of your obligation rather than storage, ask SailPoint directly and get the answer in writing.
On CERT-In: the 180-day ICT log duty applies to you as the regulated entity, not to SailPoint. CERT-In’s own FAQ permits storage outside India provided logs are producible to the authorities in reasonable time — but if you are IRDAI-regulated, the 2023 audit annexure asks as a plain yes/no whether ICT logs are stored in India, and that is where an offshore region actually costs you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The SailPoint platform family
This page covers Identity Security Cloud — the platform. The rest of the portfolio:
Quick facts
30-second orientation- Product
- Identity Security Cloud — on the Atlas core
- Vendor
- SailPoint (Nasdaq: SAIL) — re-listed Feb 2025
- The category
- Identity governance & administration (IGA)
- The three questions
- Who has access · should they · can you prove it
- Market position
- #1 by revenue in IGA — Gartner Market Share 2024
- THE India fact
- AWS Mumbai region since 27 Nov 2024 — 9th globally
- Residency scope
- That statement covers STORAGE — not processing
- Pricing
- QUOTE-ONLY — no published rate card
- ⚠️ The real cost
- Implementation commonly 2–3× the licence
- Minimum viable size
- Below ~1,000 identities, hard to justify
- Analyst standing
- NO IGA Magic Quadrant exists — it is a Market Guide
- In India via
- TechBag — connector scoping, INR invoicing, GST
Understand identity governance before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is Identity Security Cloud?
The identity governance category leader’s flagship — certification campaigns, SoD policy, role mining and the evidence trail an auditor accepts, on the Atlas core. Runs in AWS Mumbai for Indian customers.
A spreadsheet review vs governance you can evidence — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Manual reviews in a spreadsheet | Identity Security Cloud (SailPoint) |
|---|---|---|
| The access review | A spreadsheet emailed to managers | Campaigns with business context |
| Evidence | Reconstructed after the audit asks | Recorded as decisions are made |
| Roles | Designed on a whiteboard | Mined from real entitlement data |
| Toxic combinations | Found after the incident | SoD rules, before the grant |
| Leavers | Removed when someone remembers | Revoked on the HR event |
| Machine accounts | Nobody owns them | Discovered, classified, owned |
| India data | (varies — often unstated) | AWS Mumbai, isolated — for STORAGE |
| The real cost | (varies) | 2–3× licence — budget the programme |
The identity governance category leader — #1 by revenue in Gartner’s 2024 market-share research, with the strongest documented India data-storage position in the category (AWS Mumbai, isolated, since Nov 2024). Honest: implementation typically costs 2–3× the licence, below ~1,000 identities the economics are hard, the Mumbai statement covers STORAGE not processing, and there is NO Gartner Magic Quadrant for IGA — so nobody leads one.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Atlas — The Core
The Atlas core holds one model of every identity and entitlement, wherever they live; certification, provisioning and policy all read from it.
Joiner-Mover-Leaver
Access granted on day one, updated on role change and revoked on the last day, driven by HR or directory events — the half cheaper tools also do.
Access Certification
Managers and owners periodically confirm their people’s access. The hard part is making reviews meaningful, not rubber-stamped raw entitlement names.
Roles & Role Mining
Role mining derives roles from what people actually hold, not a whiteboard. Expect a real analytical project — a big part of implementation cost.
Segregation of Duties
SoD rules stop one person, say, raising and approving a purchase order. Regulated Indian auditors ask about this most; lifecycle-only tools can’t answer.
One model of every identity and entitlement on Atlas — access granted, reviewed and revoked by policy, not by ticket.
Twelve capabilities. Ingest, govern, evidence.
Identity Security Cloud produces the evidence that access was reviewed and understood — not just that accounts were created and removed — the flagship of the SailPoint portfolio.
One View Of Every Identity
One model of employees, contractors, service accounts and machine identities across cloud, SaaS and on-prem; connectors decide its value.
Entitlement Discovery & Correlation
Finds the granular permissions inside each application and correlates them to the people who hold them — the foundation of everything else.
Access Analytics & Risk Insight
Identifies outliers and over-privileged accounts against peer groups, so certification targets the access most likely to be wrong.
Automated Provisioning & Deprovisioning
Accounts created on day one and removed on the last day, driven by HR or directory events. Cheaper tools do this too.
Access Certification Campaigns
Scheduled reviews where owners confirm access is still appropriate, with the context to make a real decision, not a click-through.
Role Modelling & Mining
Derives roles from actual entitlement data and manages them as the organisation changes. A real analytical project, not a switch.
Segregation-Of-Duties Rules
Detects and prevents toxic access combinations, and finds existing ones — what regulated Indian auditors ask about most.
Self-Service Access Requests
People request access from a catalogue, approvals route by policy, and provisioning follows — with a record of why each grant was made.
The Audit Evidence Trail
Every decision, approval and revocation recorded in a form you can hand to an auditor — the actual deliverable of an IGA programme.
Connectors & Integrations
Connectors to governed applications; SAP GRC Firefighter, BeyondTrust and JDBC were added in September 2025. Scope this list before signing.
Machine & Non-Human Identity
Discovers, classifies and assigns owners to service accounts, bots and shared accounts (sub-types added September 2025).
AWS Mumbai — Documented
The India region, live since 27 November 2024, is isolated from other AWS regions, with nothing stored elsewhere. Storage, not processing.
Watch Identity Security Cloud in action
The platform, demonstrated by SailPoint.
SailPoint Identity Security Cloud Overview
The platform, introduced by SailPoint.
A guide to SailPoint Identity Security Cloud
A product-marketing walkthrough of the suites.
SailPoint Non-Employee Risk Management Overview
The contractor and partner add-on.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Accounts created and removed. Or access you can prove.
Here’s what genuinely sets it apart — starting with the cost reality most buyers meet late.
The licence is not your budget — and this is the most useful thing we can tell you
Third-party reporting puts SailPoint implementation at two to three times licence cost. The work is connectors, role modelling from messy data and certification design — true of any vendor here. Price the connector list first, distrust cheap services quotes, and below roughly a thousand identities consider lighter provisioning.
Governance is the evidence, not the provisioning
Provisioning automates joiners, movers and leavers, and cheaper tools — even Microsoft Entra or Okta — do it well. Governance adds certification, segregation of duties and an evidence trail an auditor can inspect. A slow onboarding process is provisioning; an audit finding is governance. Don’t pay governance prices for provisioning.
The Mumbai region, stated exactly
SailPoint has run on AWS Asia Pacific (Mumbai) since 27 November 2024, isolated, with no data replicated, backed up or stored in another region. That covers storage, not processing, which matters for some IRDAI-regulated buyers. CERT-In’s 180-day log duty falls on you. Get the region and sub-processors into the contract.
Category leadership, and the quadrant that does not exist
Gartner’s Market Share: Security Software, Worldwide 2024 ranks SailPoint first by IGA revenue, and its filings show $1.125 billion ARR in FY2026, up 28 percent. There is no current IGA Magic Quadrant — Gartner published a Market Guide on 2 October 2025, the last MQ appears to be 2019 — so treat any ‘IGA MQ Leader’ claim with suspicion.
The honest scope
The IGA category leader, running in AWS Mumbai since November 2024. Saviynt suits SAP-heavy estates; Idira (CyberArk) suits teams on its PAM; Omada is faster to deploy but has no India office. Implementation runs two to three times licence, pricing is quote-only, and below roughly a thousand identities it rarely pays.
The numbers behind the platform
What your Identity Security Cloud evaluation looks like
Name what actually triggered this
An audit finding means governance; slow onboarding means provisioning. And does your obligation cover storage or processing?
Scope the connector list — before anything else
List every application to govern, mark which need custom connectors, and price them. That predicts timeline and services cost.
Pilot a real certification campaign
Run one campaign on one real application. The test is whether managers understood what they approved, not whether it completed.
Expand by risk, not alphabetically
Onboard applications in order of risk. TechBag tracks the connector backlog and gets the Mumbai region into the contract.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our auditor wanted proof that core banking access was reviewed and understood. Before SailPoint we had a spreadsheet; now, a trail.”
“The Mumbai region got it shortlisted. Compliance had ruled out two competitors that couldn’t say where our identity data would sit.”
“Budget for the programme, not the licence. Our services cost more than twice the software, even with a well-scoped connector list.”
“Role mining was humbling: the roles we thought we had and the roles we actually had were different. That alone was worth it.”
“We were too small — around 700 identities. TechBag said so during scoping and we chose a lighter tool. It cost them the sale.”
“Campaigns only worked once we described entitlements in business language. With raw strings, managers approved everything.”
“We compared it with Saviynt. For our SAP-heavy estate their Application Access Governance won; for the rest of the group, SailPoint.”
“Being able to check the ARR figures in an actual filing rather than a press release mattered to our procurement team more than I expected.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the identity governance market — tap any vendor to see why it sits where it does.
TechBag Identity Governance Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Category leader by revenue. This page's product.
Governance Depth × Speed to Value
The grid nobody publishes — how deep the governance goes vs how fast you get there.
Deepest governance; heaviest implementation.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
SailPoint vs the identity governance field
Saviynt, Idira (the rebranded CyberArk), One Identity, Omada and Okta — honest lanes. The edge here is governance depth and a documented Mumbai region. SAP-heavy with SoD as the driver? Saviynt’s AAG genuinely goes further, and we sell it.
| Dimension | SailPoint ISC | Saviynt | Idira (was CyberArk) | One Identity | Omada | Okta IGA |
|---|---|---|---|---|---|---|
| Position | Category leader by revenue | Converged IGA+PAM+AAG | IGA module in a PAM platform | Established, on-prem heritage | Pure IGA, European | Governance beside access mgmt |
| Certification depth | Deep — the reference implementation | Deep | Strong (Zilla lineage) | Deep | Deep, standards-driven | Lighter |
| SAP / ERP SoD | Via Access Risk Management | AAG — a genuine differentiator | Present | Present | Partner-led | Not a focus |
| India data region | AWS MUMBAI, documented + isolated | India tenants, regions unnamed | Not documented | Not documented | No India region at all | India tenants (Jan 2026) |
| India engineering | Pune since 2011, 200+ (2023) | Bengaluru — LARGEST global hub, 650+ | Regional | Regional | No India office | Regional |
| Financials verifiable | Public (Nasdaq: SAIL) — in filings | Private — not disclosed | Within Palo Alto Networks | Within Quest | Private — not disclosed | Public (Nasdaq: OKTA) |
| Implementation burden | 2–3× licence — the honest warning | Reported as heavy | Quarters-long | Substantial | Faster — config over code | Lighter |
| Best fit | Large regulated estates needing defensible evidence | SAP-heavy estates; converged IGA+PAM | Where you already run that PAM | On-prem heritage estates | Faster pure-IGA, if India is not a constraint | Where Okta is already the access layer |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Identity Security Cloud if…
- ✓Your driver is defensible ACCESS REVIEWS — certification, SoD and an evidence trail an auditor accepts
- ✓You have more than roughly a thousand identities, so the programme economics work
- ✓A documented India data region matters — AWS Mumbai, isolated, since November 2024
- ✓You can budget the PROGRAMME rather than the licence: implementation typically runs 2–3×
Saviynt if…
- ✓Your estate is SAP-heavy and ERP segregation-of-duties analysis is the driver — its Application Access Governance module is a genuine differentiator, and its Bengaluru hub is its largest globally
Idira (was CyberArk) if…
- ✓You already run that PAM and want privileged accounts inside the same certification campaign — though IGA is a supporting module there, not the flagship
Omada if…
- ✓You want pure IGA, faster to deploy, and India presence is genuinely not a constraint — it has no India office at all
Something lighter if…
- ✓Your real problem is provisioning speed rather than audit evidence, or you are under ~1,000 identities — we will tell you when that is the case
SailPoint Identity Security Cloud is one of 22 identity governance products TechBag carries. The Identity Governance guide narrows them to a shortlist and shows the reasoning. →
What do manual access reviews cost you?
Drag the sliders (identity count; IT hourly cost as a loaded rate). Estimates contrast manual access reviews — spreadsheets emailed to managers, evidence reconstructed after the auditor asks, leavers removed when somebody remembers — against automated certification with a recorded evidence trail. NB: this models the REVIEW effort saved. It does NOT model implementation, which typically costs 2–3× the licence and is the larger number — scope the connector list to size that. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
SailPoint is QUOTE-ONLY with no published rate card, and we will not print the third-party figures circulating (“$11 per identity”, “$825k for 2,500 identities”) because they are blog estimates, not SailPoint’s. The number that matters more: third-party reporting consistently puts IMPLEMENTATION at 2–3× licence cost — connectors, role modelling and certification design are real work. Budget the programme, price the connector list before committing, and be suspicious of any proposal where services look cheap. Below ~1,000 identities the economics are hard to justify and we will say so. TechBag obtains the quote and invoices in INR with GST.
Identity Security Cloud
Best for defensible access reviews
- QUOTE-ONLY — no published rate card, per identity
- Certification, SoD, role mining and the audit evidence trail
- AWS Mumbai region since Nov 2024 — documented for STORAGE
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ the programme
Best budgeted before you sign
- Implementation commonly 2–3× the licence — the honest warning
- The connector list drives timeline and services cost
- TechBag prices it against Saviynt, in INR with GST
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Did an auditor trigger this, or slow onboarding? The second is a much cheaper problem than governance.
Have you listed every application to govern and priced those without supported connectors? That drives the timeline.
Is your budget built on implementation, typically 2–3× the software? A proposal with cheap services hasn’t been scoped.
Do you have more than roughly a thousand identities? Below that the fixed programme cost is genuinely hard to justify.
Does your obligation cover where data is stored or processed? Mumbai is documented for storage only.
In the pilot, did reviewers understand what they were approving, or did raw entitlement strings invite rubber-stamping?
Is ERP segregation of duties the real driver? If so, compare Saviynt's Application Access Governance module seriously before deciding.
Comfortable that Thoma Bravo retains ~88%, making SailPoint a controlled company? Worth weighing on a decade-long platform commitment.
Questions buyers ask
Ready to scope it properly?
Start with what triggered the project — an audit finding means governance, a slow onboarding process means provisioning and costs far less. Then price the connector list, because it drives everything. Or let a TechBag advisor qualify it honestly against Saviynt and against doing less; we have talked buyers out of this product when they were under a thousand identities.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.