How Thales CipherTrust and AWS KMS differ on scope, key custody, deployment and cost.
| Thales CipherTrust | AWS KMS | |
|---|---|---|
| Type | Enterprise KMS | Cloud KMS |
| Scope | Keys, encryption, tokenisation | Encryption keys |
| Deployment | On-premise + cloud | SaaS (AWS) |
| Key custody | Luna HSMs; FIPS 140-3 Level 3, Common Criteria | FIPS 140-3 Level 3 validated HSMs |
| How it works | A manager plus a family of connectors covering database, file and application encryption, backed by Luna HSMs. It descends from Gemalto and SafeNet, which is precisely why it appears in compliance checklists — the pedigree is the product as much as the software is. | Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value. |
| Pricing* | Enterprise quote | $1/key/mo + $0.03 per 10k requests |
| Free tier | No | Yes |
| Licence | — | — |
| Best for | Regulated estates with auditors to satisfy | Anything already running on AWS |
Choose Thales CipherTrust for regulated estates with auditors to satisfy. Choose AWS KMS for anything already running on aws.
* Published list pricing (vendor pricing pages, August 2026).