How Thales CipherTrust and Google Cloud KMS differ on scope, key custody, deployment and cost.
| Thales CipherTrust | Google Cloud KMS | |
|---|---|---|
| Type | Enterprise KMS | Cloud KMS |
| Scope | Keys, encryption, tokenisation | Encryption keys |
| Deployment | On-premise + cloud | SaaS (GCP) |
| Key custody | Luna HSMs; FIPS 140-3 Level 3, Common Criteria | HSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keys |
| How it works | A manager plus a family of connectors covering database, file and application encryption, backed by Luna HSMs. It descends from Gemalto and SafeNet, which is precisely why it appears in compliance checklists — the pedigree is the product as much as the software is. | Key rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy. |
| Pricing* | Enterprise quote | Metered per key version + operations |
| Free tier | No | No |
| Licence | — | — |
| Best for | Regulated estates with auditors to satisfy | GCP workloads and hold-your-own-key rules |
Choose Thales CipherTrust for regulated estates with auditors to satisfy. Choose Google Cloud KMS for gcp workloads and hold-your-own-key rules.
* Published list pricing (vendor pricing pages, August 2026).