Thales CipherTrust Data Discovery & Classification
You cannot encrypt what nobody knows exists — discovery scans structured and unstructured stores to find sensitive data and label it, and the output drives encryption policy directly rather than becoming a report nobody acts on.
Data residency & processing — two different questions
Where data lives
Yours — deploy on-premises in India
CipherTrust Manager deploys as a virtual appliance or physical hardware in your own data centre, and Luna HSM is a box you own. Keys, ciphertext and policy stay on infrastructure you control — the best answer available on Indian residency, since what you produce is an access log and a device serial number rather than a contractual clause.
The constraint, stated plainly
No India SaaS region — and Noida is people, not data
CipherTrust as-a-Service runs in Europe and North America only. Thales has 2,200+ staff in India with Noida as its Cyber & Digital engineering centre, and that is a genuine commitment — but people in India and data in India are different facts. An audit is where mistaking an engineering presence for residency gets exposed.
For a residency-bound Indian buyer this pushes you to on-premises deployment, which is very likely what your regulator wanted anyway. Under the DPDP Act the sequence matters more than the product: find the personal data first, then protect it. For RBI-regulated entities the question behind the question is usually who can decrypt, and whether administrators can read production data — both answerable here with evidence rather than assurance. And note what does not exist, so its absence is not misread: Gartner publishes no Magic Quadrant for HSM or key management at all, only Market Guides, which have no Leader quadrant. No vendor in this category has a Gartner Leader placement, and any implying one is misleading you.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Thales platform family
This page covers CipherTrust Data Discovery & Classification — the starting point. The rest of the Thales data-security platform:
Quick facts
30-second orientation- Product
- CipherTrust Data Discovery & Classification
- What it does
- Finds and classifies sensitive data across your stores
- Why it matters first
- DPDP's real first question is where personal data is
- The point
- Output drives encryption policy, not a spreadsheet
- Vendor
- Thales — Chairman & CEO Patrice Caine
- The cyber arm
- Thales Cloud Protection & Licensing
- Analyst standing
- KuppingerCole Overall Leader 2025 — Data Security Platforms
- Gartner
- No MQ exists for HSM or key management — Market Guides only
- India engineering
- 2,200+ staff; Noida is the Cyber & Digital centre
- Data residency
- Yours — deploy on-premises or virtual in India
- Data processing
- On your infrastructure; CipherTrust SaaS is EU/NA only
- Pricing
- Quote-only — no published list price
- Buy in India via
- TechBag — INR, GST, key-custody scoping
Understand data discovery and classification before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Scanning that finds sensitive data across structured and unstructured stores and classifies what it finds — the prerequisite to every other control on this platform.
Inventories and questionnaires vs a scan (Discovery & Classification) — the honest table
What a scan actually changes about knowing your data, dimension by dimension.
| Dimension | Inventory & questionnaires | Discovery & Classification |
|---|---|---|
| Where data is | What people remember | What a scan finds |
| Shadow copies | Invisible | Found in shares, replicas and cloud stores |
| Classification | Manual, by each owner | 250+ infotypes plus custom ones |
| Secrets in files | Unknown | 30+ secret types detected |
| Protection status | Assumed | Shown per data object |
| Freshness | An annual questionnaire | Scheduled rescans |
| Cost driver | Staff time | Volume of new data scanned |
| Best fit | Small, well-documented estates | Estates older than their documentation |
CipherTrust Data Discovery & Classification scans files, databases, big-data and cloud stores, classifies what it finds and shows whether each sensitive object is already encrypted. It finds; it does not protect. Licensed by volume of data scanned; Thales publishes no list price. TechBag quotes in INR with GST.
The five pieces of Discovery & Classification
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s how a scan works, demystified.
The console
Scans are configured from the CipherTrust Manager console or REST API, so discovery shares users, roles and logging with the rest of the platform.
Data stores
Windows and Linux hosts, SMB and NFS shares, Oracle, SQL Server, DB2, PostgreSQL, MySQL, MongoDB, SAP HANA, Hadoop, Teradata, S3, Azure, Office 365 and Salesforce.
Agents
Local agents scan on the host so data never leaves it; proxy agents reach remote stores. Agents are unlimited, because licensing is by the volume of data scanned.
Classification profiles
Profiles group infotypes — financial, personal, medical, national ID, secrets — aligned to laws such as GDPR, HIPAA and PCI DSS, and you can add custom ones.
Reports
Reports rank sensitive data objects by exposure risk and show whether an encryption policy already protects each one.
Scan, classify, rank — then hand the result to the encryption policy rather than a spreadsheet.
Twelve capabilities. Find, classify, act.
What Data Discovery & Classification actually does — finds sensitive data wherever it sits, labels it against profiles you control, and turns findings into a ranked remediation list.
Structured and Unstructured
Databases, file shares, big-data clusters and cloud stores in one tool, rather than a separate scanner for each data type.
Local or Proxy Scanning
Local agents keep scanning on the host; proxy agents scan remote stores without installing anything on them.
Whole Targets, Not Samples
Thales says DDC scans whole targets rather than sampling — which is how the one forgotten spreadsheet gets found.
Scheduled Rescans
Scans run on demand or on a schedule, because data moves and a one-off scan is stale by next quarter.
250+ Prebuilt Infotypes
Prebuilt patterns across financial, personal, medical, national-ID and secrets categories, grouped into classification profiles.
Your Own Infotypes
Define patterns for employee IDs, policy numbers or any identifier the prebuilt list does not cover, and add them to profiles.
Regulation Templates
Prebuilt profiles for GDPR, CCPA, HIPAA, LGPD, PCI DSS, APPI and UK GDPR; no DPDP profile appears in Thales’s published list.
Secrets Discovery
Finds more than 30 types of secrets — AES keys, auth secrets, SSH keys — left behind in files and code.
Objects Ranked by Risk
Sensitive data objects are sorted by risk of exposure, so the first remediation work goes where it matters most.
Encryption Status per Object
Reports show whether an encryption policy is already active on each sensitive object — the link to Transparent Encryption.
Data Left Where It Is
Source data is not moved or modified; agents read a temporary in-memory copy and send back only a summary.
NDJSON Export
Scan results export as NDJSON for your own reporting tools and data-protection dashboards.
Watch Discovery & Classification in action
The overview, getting started, and the core workflows.
CipherTrust Data Security Platform — Overview
Where discovery sits in the platform.
CipherTrust — Advanced Encryption
What discovery output feeds into.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Inventories drift. Scans find what’s there.
Here’s what genuinely sets Discovery & Classification apart (and where a specialist scanner goes further).
Every other control has to be pointed at something
Encryption and access policy are only as well aimed as your inventory, and inventories miss data that accumulates by accident: the reporting replica, the analytics extract, the old file share. None is in the CMDB, and all are where breaches and DPDP complaints start. Scanning finds them; asking does not.
DPDP makes this the first question, not the third
India’s DPDP Act requires you to know what personal data you hold and where, which is a discovery problem, not documentation. Teams that start with encryption and defer discovery usually restart halfway; beginning with the scan is slower to start but faster to finish, and produces regulator-ready evidence.
Classification that triggers protection, not a report
Standalone discovery often ends in a detailed report nobody acts on, because acting needs a separate, funded project. Inside the CipherTrust platform, discovery feeds encryption and access policy directly, so a classification decision becomes a protection decision instead of an audit artefact.
The honest limit: this finds, it does not protect
Discovery and classification show where sensitive data is and what it is, but they don’t encrypt it, control access or follow it. That knowledge is valuable but isn’t protection, so budget it alongside encryption and key management, and treat a finished scan as the start of the work.
The honest positioning
Start here if you can’t say where your personal or sensitive data lives, true of most organisations a few years old. Start elsewhere if you have a trustworthy data map and only need protection. If another vendor’s classification already works, keep it; we would rather feed it into protection than sell a second scanner.
The numbers behind the platform
What your Discovery & Classification journey looks like
List the stores you know
Start with the shares, databases and cloud buckets you can name, and the owners who can grant scan access.
Choose profiles, add your patterns
Pick prebuilt profiles, then add custom infotypes for identifiers specific to you — customer IDs, policy numbers.
Scan in small batches
Test on one store first, then widen. Proxy agents are quickest to start; local agents keep data on the host.
Rank and route findings
Use the data-object risk view to hand each owner a short list, not a thousand-row export.
Rescan and close the loop
Schedule rescans, and track how many high-risk objects now show an active encryption policy.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The first scan found card numbers in a finance share that three audits had missed. That one report justified the purchase.”
“Proxy agents had us scanning within a week; local agents on the big file servers came later, once the change board relaxed.”
“We added custom infotypes for our policy numbers on day two. The prebuilt ones alone missed much of what mattered to us.”
“Seeing which sensitive folders already had an encryption policy turned a spreadsheet exercise into a remediation queue.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the sensitive-data discovery market — tap any vendor to see why it sits where it does.
TechBag Data Discovery Grid
Execution strength vs product vision among sensitive-data discovery tools.
Discovery built to feed encryption policy.
Discovery Depth × Link to Protection
How deep the discovery goes vs how directly the findings drive protection.
Findings flow straight into encryption policy.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Discovery & Classification vs the data-discovery field
Microsoft Purview, BigID and Varonis — honest lanes. Purview is strongest inside Microsoft 365; BigID treats discovery as its own programme; Varonis leads on file access. DDC’s edge is findings that feed encryption policy directly. We say so.
| Dimension | Thales DDC | Microsoft Purview | BigID | Varonis | Standalone PII scanners |
|---|---|---|---|---|---|
| What it is | Discovery inside the encryption platform | Classification inside Microsoft 365 and Azure | Discovery and data-intelligence specialist | Data security platform, file-access heritage | Point tools that pattern-match PII |
| Coverage | Files, databases, big data, cloud | Deepest inside Microsoft | Broad connector catalogue | Files, Microsoft 365, cloud, databases | Varies by tool |
| Findings drive protection | Feeds CipherTrust encryption policy | Feeds sensitivity labels and DLP | Through integrations | Remediates access and exposure | A report |
| Runs on your infrastructure | Yes — on CipherTrust Manager | Microsoft cloud service | Check deployment options | Check self-hosted options | Usually |
| Licensing | By volume of new data scanned | Within E5 or Purview add-ons | Quote | Quote | Varies |
| The thing to plan around | No DPDP template in the published list | Strongest inside Microsoft only | Protection needs another product | A larger platform purchase | Findings with no follow-through |
| Best fit | Discovery that should drive encryption | Microsoft 365-centred estates | Discovery as its own programme | File-access risk and over-sharing | A one-off audit |
Which way of finding sensitive data fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Discovery & Classification if…
- ✓You are about to encrypt, and need to know what and where first
- ✓Findings should become encryption policy, not a spreadsheet
- ✓You want discovery on infrastructure you run, in India
- ✓You already run, or plan, CipherTrust Manager
Microsoft Purview if…
- ✓Most sensitive data lives in Microsoft 365 and you hold E5
BigID if…
- ✓Discovery and data intelligence are a programme in their own right
Varonis if…
- ✓Over-shared files and who can open them are the core risk
Keep what you have if…
- ✓An existing scanner works — then connect its output to protection instead
Thales CipherTrust Data Discovery & Classification is one of 22 encryption & rights management products TechBag carries. The encryption & rights management guide narrows them to a shortlist and shows the reasoning. →
What could this save you?
Drag the sliders (data stores brought under scheduled scanning; loaded analyst-hour cost). The estimate contrasts manual data mapping — owner questionnaires, spreadsheet inventories, ad-hoc searches — with scheduled scans and ranked findings. Illustrative — TechBag scopes your estate.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Discovery & Classification is quote-priced, licensed by the volume of new data scanned — agents are unlimited — and it runs on CipherTrust Manager. Thales publishes no list price. TechBag quotes in INR with GST.
DDC licence
Best for a first data map
- Licensed by volume of new data scanned
- Unlimited local and proxy agents
- Runs from the CipherTrust Manager console
+ Protection
Best for acting on findings
- Transparent Encryption for sensitive folders
- Encryption status shown per data object
- One policy and audit trail across both
+ TechBag scoping
Best value with TechBag
- Scan plan and data-volume estimate
- Custom infotypes for your own identifiers
- INR invoicing with GST, local support
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Are all our data-store types — Oracle, SAP HANA, NFS, Office 365 — on the supported list?
Which identifiers matter to us — Aadhaar, PAN, internal IDs — and are they prebuilt or custom?
How will we map findings to DPDP duties, given no DPDP template appears in the published list?
Where must local agents keep data on the host, and where are proxy agents acceptable?
How much new data will we scan each year, since that drives the licence?
Who grants scan credentials for each store, and how are they protected?
Who owns remediation for each finding, and how will we track it to closure?
How often will we rescan, and who reviews what changed between scans?
Questions buyers ask
Ready to find out where your sensitive data is?
Scope Data Discovery & Classification with a TechBag advisor — which stores to scan first, local or proxy agents, custom infotypes for your identifiers and a realistic data-volume estimate — compared honestly against Purview, BigID and Varonis, and quoted in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.