How Fortanix DSM and Thales CipherTrust differ on scope, key custody, deployment and cost.
| Fortanix DSM | Thales CipherTrust | |
|---|---|---|
| Type | Confidential computing KMS | Enterprise KMS |
| Scope | Keys, secrets, tokenisation | Keys, encryption, tokenisation |
| Deployment | SaaS + on-premise | On-premise + cloud |
| Key custody | Intel SGX enclaves; FIPS 140-2 Level 3 | Luna HSMs; FIPS 140-3 Level 3, Common Criteria |
| How it works | Data Security Manager runs key operations inside confidential-computing enclaves rather than conventional HSM appliances, presenting one key management plane across multiple clouds and on-premise. Also covers tokenisation and, increasingly, post-quantum readiness. | A manager plus a family of connectors covering database, file and application encryption, backed by Luna HSMs. It descends from Gemalto and SafeNet, which is precisely why it appears in compliance checklists — the pedigree is the product as much as the software is. |
| Pricing* | Enterprise quote | Enterprise quote |
| Free tier | No | No |
| Licence | — | — |
| Best for | Multi-cloud estates with strict key custody | Regulated estates with auditors to satisfy |
Choose Fortanix DSM for multi-cloud estates with strict key custody. Choose Thales CipherTrust for regulated estates with auditors to satisfy.
* Published list pricing (vendor pricing pages, August 2026).