How Thales CipherTrust and Azure Key Vault differ on scope, key custody, deployment and cost.
| Thales CipherTrust | Azure Key Vault | |
|---|---|---|
| Type | Enterprise KMS | Cloud KMS |
| Scope | Keys, encryption, tokenisation | Keys, secrets, certificates |
| Deployment | On-premise + cloud | SaaS (Azure) |
| Key custody | Luna HSMs; FIPS 140-3 Level 3, Common Criteria | Premium tier: FIPS 140-2 Level 2/3 HSMs; Managed HSM available |
| How it works | A manager plus a family of connectors covering database, file and application encryption, backed by Luna HSMs. It descends from Gemalto and SafeNet, which is precisely why it appears in compliance checklists — the pedigree is the product as much as the software is. | One service holding three different things: cryptographic keys, arbitrary secrets and TLS certificates. Standard is software-protected, Premium is HSM-backed, and Managed HSM gives a single-tenant pool. Certificate lifecycle is included, which the other clouds keep separate. |
| Pricing* | Enterprise quote | Metered per operation; Premium adds HSM |
| Free tier | No | No |
| Licence | — | — |
| Best for | Regulated estates with auditors to satisfy | Microsoft-centric estates |
Choose Thales CipherTrust for regulated estates with auditors to satisfy. Choose Azure Key Vault for microsoft-centric estates.
* Published list pricing (vendor pricing pages, August 2026).