Thales CipherTrust Data Security Platform

CipherTrust Manager is the central console that every other CipherTrust product plugs into - it generates, stores, rotates, and retires encryption keys across on-premises and cloud environments from one place, instead of each application or database managing its own keys separately. That fragmentation - keys scattered across dozens of systems with no consistent policy or audit trail - is exactly the problem it solves.

Available as a virtual or physical appliance, it integrates with a broad partner ecosystem of enterprise storage, database, and SaaS vendors, so it becomes the single point of control an auditor can point to when asked "who can access your encryption keys, and how do you know?"

CipherTrust Transparent Encryption protects data at the file-system or volume level - encrypting files, folders, and databases without touching the applications that use them, so there's no code to rewrite and no performance-killing redesign. It directly addresses the scenario where an attacker or a rogue insider gets read access to a file server or database volume: without the right keys and privileges, what they find is unreadable.

Beyond encryption, it enforces privileged-user access controls - even a database administrator with full OS access doesn't automatically get to read the protected data - and logs every access attempt, which is exactly the audit trail that PCI DSS, HIPAA, and GDPR assessments ask for.

You cannot protect data you don't know you have. Data Discovery and Classification scans structured and unstructured repositories - databases, file shares, cloud storage, big data platforms - and automatically identifies and classifies sensitive data, using pre-built templates for GDPR, CCPA, HIPAA, PCI DSS, LGPD, and other frameworks.

It's usually the starting point of a data-security project rather than the end of one: once you know where sensitive data actually lives, which is frequently a surprise, the output feeds directly into where to apply Transparent Encryption or Tokenization next, rather than encrypting everything indiscriminately or guessing.

Tokenization replaces a sensitive value - a card number, a national ID, a customer record - with a non-sensitive token that has no exploitable value if it's exposed, while the real data sits protected in CipherTrust. For a PCI DSS assessment specifically, this is a direct cost lever: systems that only ever see tokens, never real card numbers, can fall outside PCI DSS scope entirely, which shrinks both the audit and its cost.

It comes in two forms - vaultless tokenization, which generates tokens on demand without a separate token database, and vaulted tokenization, which stores token-to-value mappings for cases that need that model - so the deployment matches the compliance and performance requirements rather than forcing one architecture on every use case.

Every major cloud provider offers its own native key management service - and if you use three clouds, that's three separate consoles, three separate policies, and three separate places an auditor has to check. CipherTrust Cloud Key Manager gives you one console for encryption keys across AWS, Azure, Google Cloud, IBM Cloud, Oracle Cloud, Salesforce, and SAP, instead of learning and maintaining each provider's own tooling.

It supports both Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK) models, so organizations that need to keep ultimate control of their keys, rather than trusting a cloud provider to hold them, have a supported way to do that without giving up the operational convenience of native cloud encryption.

Every application, script, and CI/CD pipeline needs its own credentials, API keys, and certificates - and by Thales's own research, 62% of organizations don't actually know how many of these secrets they have across their company. That's secrets sprawl, and it's a common breach vector: a leaked API key in a code repository or a forgotten hardcoded credential doesn't need a sophisticated attack to be exploited.

CipherTrust Secrets Management, powered by Akeyless, automates the creation, rotation, and removal of secrets across DevOps tools and cloud workloads, and - unlike a lot of secrets tools bolted on after the fact - it's accessible directly from the same CipherTrust Manager console as your encryption keys, rather than being yet another separate system to manage and audit.