Thales
The key-custody specialist — CipherTrust key management and encryption, and Luna HSM hardware, so the answer to “who can decrypt this?” is you. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Five intel pages. One key-custody platform.
The Thales data-security portfolio on TechBag — every linked card is a full intel page, from the key authority and the HSM to discovery and secrets.
CipherTrust Manager
One place that decides who can decrypt what.
Generates, stores, rotates and controls access to keys for the whole CipherTrust platform, and decides which app or user may use them.
CipherTrust Transparent Encryption
Files and databases encrypted, apps untouched.
An agent between app and storage encrypts data at rest and enforces policy; root and DBA accounts administer without reading the data.
Luna HSM
Keys generated in hardware that stays on site.
A tamper-resistant appliance that generates and uses keys inside the device; no cloud provider, vendor or admin can extract them.
CipherTrust Data Discovery & Classification
You cannot encrypt what nobody knows exists.
Finds and classifies sensitive data in structured and unstructured stores, and feeds it straight into encryption and access policy.
CipherTrust Secrets Management
Credentials your applications use, held properly.
Centralises the API keys, database passwords, certificates and tokens apps and pipelines need, out of config files and source control.
CipherTrust Cloud Key Manager
Platform & engineBring-your-own-key across cloud providers, from one console
Imperva
Platform & engineAcquired Dec 2023 for $3.6B — data and application security, a separate portfolio
Thales is one of 21 encryption & rights management products TechBag carries. The Data Security & Privacy guide shows how the category splits and which part is yours. →
Why “who holds the key” is the whole story
Cloud providers encrypt data at rest by default, and it genuinely helps — against a stolen disk. It does nothing about the provider, because they hold the key. When an Indian regulator asks about data protection, the question underneath is not whether the data is encrypted but whether you can demonstrate that a third party cannot decrypt it— and provider-managed encryption cannot answer that at all. Thales exists to invert the arrangement: keys generated inside a Luna HSM in your own data centre, under a CipherTrust Manager your people operate, so the answer to the auditor is evidence rather than a contractual assurance. Everything else on this page — transparent encryption, discovery, secrets — is built on that one idea.
Customer-held keys
If the provider holds the key, it can decrypt your data under a lawful order without you. Keys made in a Luna HSM under your CipherTrust Manager make custody demonstrable, not contractual.
Encryption without app rewrites
Transparent Encryption puts an agent between application and storage, so data on disk is protected with no code change. That makes legacy systems nobody will refactor deployable.
Privileged users, blind to data
Transparent Encryption lets root accounts and DBAs run a system without reading the customer data in it, the control RBI or SEBI reviewers probe when asking who sees production data.
Analyst standing, precisely
Overall Leader in two 2025 KuppingerCole Compasses: Data Security Platforms and Enterprise Secrets Management. Gartner has no Magic Quadrant for hardware security modules or key management.
India, concretely
Two engineering centres in India (Noida is Cyber and Digital), more than 2,200 staff, around 450 more being hired during 2026, and material mapped to SEBI’s CSCRF and RBI’s NBFC directions.
Start with where the keys live — CipherTrust Manager, rooted in a Luna HSM if your regulator requires it — then add encryption, discovery and secrets management around it.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Overall Leader
Leadership Compass, Data Security Platforms
Overall Leader
Leadership Compass, Enterprise Secrets Management
2,200+ staff
Two engineering centres; Noida is Cyber & Digital
~450 more in 2026
Growing, not consolidating
SEBI CSCRF & RBI NBFC
Thales publishes its own mapped material
Imperva, $3.6B
Cyber business expanded, not divested
No MQ exists
None for HSM or key management — Market Guides only
No India SaaS region
CipherTrust as-a-Service is EU/NA — go on-premises
The company in six figures
See the platform, hear the pitch
CipherTrust Data Security Platform — Overview
The platform, presented by Thales.
Introducing Thales Luna HSM 8 — Quantum-Safe
The hardware key custody layer.
CipherTrust Transparent Encryption — Demo
Encrypting without changing the application.
Where Thales sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Thales Across Its Platform
Each dot is a Thales product: competitive position vs category momentum.
The key authority the rest is rooted in.
The Breadth × Key Custody Map
How broad the platform is — keys, encryption, discovery, secrets — vs how firmly the customer holds the keys.
Key custody, in hardware, with India engineering.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Thales?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is actually driving this?
2. How strong does key custody need to be?
3. Where must this run?
Who holds the key, and why it decides everything
The question that separates real encryption from a compliance checkbox — and the one an Indian regulator actually asks.
Read →What an HSM is, and when you genuinely need one
Tamper-resistant key custody explained without the acronyms, and an honest account of when software key management is enough.
Read →DPDP, RBI and the key-custody question
Why 'the data is encrypted' is not an answer, and what evidence a reviewer is actually looking for.
Read →Encrypting legacy systems nobody will rewrite
How transparent encryption gets around the reason most encryption projects stall before they start.
Read →Thales, Entrust and Microsoft — different problems
Key custody, hardware roots and document rights are three distinct purchases that buyers routinely conflate.
Read →What to settle before the first demo
Deployment model, key custody and who administers the HSM — three answers that shape the whole quote.
Read →The acronym decoder
Every term on these pages, in one place- HSM
- Hardware Security Module: tamper-resistant hardware that holds keys and runs cryptography inside, never exposing them.
- Key custody
- Who holds and controls the keys; it decides whether your cloud provider can decrypt your data.
- BYOK
- Bring Your Own Key: you generate keys for a cloud provider, which still handles them in use.
- HYOK
- Hold Your Own Key: keys stay in your HSM, never reaching the provider; stronger than BYOK, more restrictive.
- Transparent encryption
- Encryption between application and storage with no application change, making legacy encryption feasible.
- Privileged-user access control
- Letting an administrator run a system without being able to read the data inside it.
- Tokenisation
- Swapping a sensitive value for a stand-in so systems that never need it never hold it; common for cardholder data.
- Key rotation
- Replacing keys on a schedule to bound a compromised key’s blast radius; hard without a key manager.
- Root of trust
- What all other security rests on; rooting CipherTrust Manager in a Luna HSM keeps master keys out of software.
- Security World
- Entrust’s model for managing keys across a group of HSMs, a term Luna-vs-nShield buyers meet early.
- DPDP Act
- India’s Digital Personal Data Protection Act; its first question is where personal data lives, so discovery comes first.
- CipherTrust Manager
- Thales’s central key authority: generates, stores, rotates and controls access to keys; can be rooted in a Luna HSM.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Decide what key custody you actually need
Software keys under your control, or keys only in tamper-resistant hardware? Your regulator usually decides; it separates CipherTrust Manager from a Luna HSM.
Settle the deployment model early
CipherTrust as-a-Service runs in Europe and North America only. If Indian residency binds you, plan CipherTrust Manager and Luna HSM in your own data centre.
Find the data before you plan the encryption
Run discovery and classification first; under DPDP, where personal data lives is the first question. Size encryption on what discovery finds.
Work out who administers the HSM
An HSM creates a new role: whoever administers the appliance should not approve key use. Name those people in procurement; retrofitting it is harder.
Test transparent encryption against a real legacy system
Test the no-application-change promise on your oldest, most business-critical system, not a clean one, and measure the performance overhead there.
Price the hardware and the operations, not just the licence
Budget each HSM, its support contract and a second unit across sites for resilience, plus the work of running them. TechBag quotes in INR with GST.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| CipherTrust Manager | Quote-only | Virtual appliance or physical hardware | The central key authority |
| Transparent Encryption | Quote-only, typically per protected host | Agent-based, no application changes | Legacy systems nobody will rewrite |
| Luna HSM | Quote-only — hardware purchase plus support | A physical appliance in your data centre | When keys must never exist in software |
| Discovery & Classification | Quote-only | Scans structured and unstructured stores | DPDP scoping before you encrypt anything |
| Secrets Management | Quote-only | Inside the CipherTrust platform | Secrets inside the key platform |
Every Thales product here is quote-only and priced in foreign currency by default — TechBag scopes what you need, costs the hardware and operations as well as the licence, and invoices in INR with GST.
Five pitfalls that cost buyers quarters
Answering "is it encrypted" when the question was "who holds the key"
Provider-managed encryption stops a stolen disk, not the provider, who holds the key. Regulators ask whether a third party can decrypt your data; answer that with customer-held keys.
Assuming there is an India SaaS region
CipherTrust as-a-Service runs in Europe and North America only, and India staff are not an India region. If residency binds you, plan on-premises or virtual deployment before any cloud trial.
Buying hardware key custody without planning the operations
An HSM needs firmware maintenance, security-domain backup, separation of duties and a second unit for site failure. Budget all of it, not just the appliance, or be surprised twice.
Encrypting before you have found the data
Scoping encryption from an asset inventory misses the reporting replica, the analytics extract and the old file share, where DPDP complaints start. Run a discovery scan first.
Treating tokenisation and encryption as interchangeable
Encryption keeps data recoverable with a key; tokenisation swaps in a stand-in so downstream systems never hold the real value, usually better for cardholder data. Pick the one that fits.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**TechBag’s illustrative estimate, not a sourced forecast — verify against a current analyst report before quoting. Secrets management and discovery are growing from smaller bases than key management and HSMs.
Key custody becoming the regulator's actual question
Indian regulators increasingly ask who can decrypt, not merely whether data is encrypted.
What it means for you
Provider-managed encryption no longer satisfies; customer-held keys become a requirement.
DPDP driving discovery before protection
The Act's practical first question is where personal data lives, which most organisations cannot answer.
What it means for you
Discovery and classification budgets now get approved before encryption budgets.
Post-quantum readiness entering HSM refresh cycles
Appliances purchased now will remain in service by the time post-quantum algorithms become mandatory.
What it means for you
Crypto-agility is now a purchase criterion; ask what the firmware path looks like.
Secrets management separating from PAM
Machine credentials and human privileged access are increasingly bought as distinct problems.
What it means for you
Secrets platforms are now judged against engineering-led tools, not your PAM vendor.
Sovereign cloud pushing on-premises key roots
Buyers adopt cloud services while insisting the key root stays in their own building.
What it means for you
Hold-your-own-key designs grow, and so do the trade-offs they impose on cloud services.
Encryption moving closer to the data
Application-level and database-level protection is displacing perimeter-only thinking.
What it means for you
The blast radius of a compromised network shrinks, at the cost of more integration work per system.
Questions buyers ask about Thales
Ready to shortlist Thales?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — key custody and deployment model, hardware sizing, an honest Entrust, Microsoft and Vault comparison, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.