Thales licensing is the set of metering schemes, enforcement mechanisms and agreement terms under which Thales sells its cybersecurity and software licensing products. There is no single Thales licence metric. A software asset manager meets at least five distinct families: the Sentinel platform that independent software vendors embed in their own products, the CipherTrust Data Security Platform, Luna hardware security modules (HSMs), the Data Protection on Demand (DPoD) cloud marketplace, and the Imperva application and data security products that Thales owns. SafeNet Trusted Access, the cloud access management service, adds a tiered subscription model.
Thales markets Sentinel as a software licensing platform for monetisation, entitlement management and licence enforcement.[14] Thales describes its Cyber Security Products (CSP) agreement as applying to all CSP products or services where there is no manually or digitally signed agreement, and states that Imperva, Inc. is part of the Thales group.[1] The agreement is divided into five parts: general terms, application security, data security, identity and access management, and services.[1] Which part governs a given product is set out in the agreement itself and was not verified for this article.
Editions
Thales publishes editions in product documentation, not in one price list. The table maps the main product lines to how each is sold and where the unit is defined.
| Product line | Forms named in Thales documents | Unit and where defined |
|---|---|---|
| Sentinel LDK | Hardware keys (Sentinel HL), software licences (Sentinel SL) and cloud licences[15]; Sentinel EMS for entitlements[13] | Network seats and Feature terms set by the software vendor[2] |
| Sentinel RMS | On-premises License Manager, cloud License Manager, leasing[3] | Tokens or quantities set by the hard limit |
| CipherTrust Manager and connectors | Virtual and physical appliances; Community Edition; trial, rental and perpetual connector licences[4] | Node, registered client, cloud unit, data allowance |
| Luna Network HSM 7 | Models 700, 750 and 790; client, feature and partition licences[6][7] | Application server; partition pack of five |
| Data Protection on Demand | Luna Cloud HSM, CipherTrust and payShield services billed upfront or in arrears[9] | Service plans |
| SafeNet Trusted Access | STA Basic, STA and STA Premium plans[10] | Subscription plan |
| Imperva | App Protect, FlexProtect, Data Security Fabric and other term-based plans[8] | Database Servers, bandwidth, requests per second, events, tokens |
The detail for each family is in the companion articles: Sentinel LDK and EMS, Sentinel RMS, CipherTrust, Luna HSM and Data Protection on Demand and Imperva.
SafeNet Trusted Access plans
SafeNet Trusted Access (STA) is sold at three levels, with higher plans including all features of the lower ones; Thales states that account managers can upgrade a plan, and that the STA Workforce edition corresponds to the Premium plan.[10] Features requiring a higher plan are visible but not configurable, and the plan is shown on the console Settings page.[10] Thales describes the licence as an all-in-one price covering access management and authentication, with no extra cost for tokens or support, and offers a 30-day trial.[11] Catalog rows: STA Basic, STA, STA Premium, plan hierarchy rule.
Metrics
| Thales term | Product | Catalog row | Definition |
|---|---|---|---|
| Network seat | Sentinel LDK | Network seat | An instance of the protected application that can be used simultaneously; seats are not assigned to specific users.[2] |
| Hard limit (token or quantity) | Sentinel RMS | License token | The number of tokens a licence can have, used either as concurrency or as a quantity. |
| Registered client | CipherTrust Transparent Encryption | CTE client | Clients registered with the CipherTrust Manager are limited to the licences purchased.[5] |
| Cloud unit | CipherTrust Cloud Key Manager | CCKM cloud unit | One unit per cloud account, subscription or project added to the Containers page. |
| Data allowance | CipherTrust DDC | DDC data allowance | Volume of data scanned within a licence period. |
| Client licence | Luna Network HSM 7 | Luna client licence | The right to connect an application server, physical or virtual, to the HSM.[6] |
| Partition licence | Luna Network HSM 7 | Luna partition licence | An upgrade pack of five application partitions.[7] |
| Database Server | Imperva | Database Server | Peak concurrent monitored database hosts in a month.[8] |
Counting and floors
Counting rules differ so much between lines that the same word can mean different things. A “client” in CipherTrust is a registered endpoint, while a “client licence” in Luna is an application server that may connect to many HSMs.[5][6] Points that commonly surprise licensees:
- CipherTrust licences are node locked. Every node in a CipherTrust Manager cluster and every clone of an appliance requires a separate virtual-appliance licence, while physical appliances are licensed out of the box.[4] Connector licences, by contrast, replicate across all cluster nodes.[4]
- Luna client licences are not tied to an HSM. One licence covers an application server running multiple applications and connecting to several Luna Network HSM 7 units, and licences are not attached to a serial number.[6]
- Imperva counts what it monitors. A database in disaster recovery that is not monitored is not counted, but a monitored high-availability database with automatic failover is.[8]
- Sentinel seats are a vendor-side cost too. A software vendor’s Sentinel LDK Master licence holds pools of seats that are drawn down as customers activate, a mechanism end customers usually never see.[2]
Virtualization and partitioning
Thales documents virtualisation rules inside each product. For virtual CipherTrust Manager, snapshot restores need no new licence but every clone does, and licence counts are tied to CPUs: k170v allows up to four CPUs and k470v more than four.[4] For Luna, an HSM is divided into logical partitions and licensed in packs of five, with fixed maxima per model.[7] For Imperva, each virtual machine running a monitored database counts as a database server, even when several VMs share one physical host.[8] See virtualization and partitioning for the general discussion.
Cloud and hosted models
Thales offers hosted equivalents of several on-premises products. Data Protection on Demand sells Luna Cloud HSM, CipherTrust and payShield services through an online marketplace with Full Upfront, Annual Upfront and Monthly Arrears billing; list prices are shown in euros while quotes can be issued in other currencies.[9] Sentinel offers cloud-served licences and, in Sentinel RMS, leasing in which a licence is delivered as sequential leases that require periodic cloud contact.[3] Imperva’s cloud services are measured by bandwidth, sites and requests, and the licence definitions state that unused monthly volume does not roll over.[8]
Programs
- Trials. Virtual CipherTrust Manager starts in Community Edition and a 90-day trial unlocks all administration features and most connectors.[4] See CipherTrust 90-day trial.
- Free edition. CipherTrust Platform Community Edition is described as free forever, with no expiration date, and includes licences for two enterprise connectors.[12] See Community Edition.
- Rental with grace. CipherTrust time-limited rental licences carry a 90-day grace period after expiry before configuration becomes read-only.[5] See rental programme.
- Support and maintenance. Luna support fees are annual, can be prepaid for up to five years, and are a percentage of the licence price.[6] See Luna support.
Audit and compliance posture
Thales products show three enforcement styles. Sentinel and CipherTrust enforce in software through licence strings generated against a lock code, so exceeding a count usually produces a warning or a refusal rather than an invoice: for example, KMIP registrations beyond the licence put CipherTrust Manager into non-compliance mode with a warning.[4] Luna client and feature licences are honour based, and the customer is expected to declare the numbers in use to the Thales account manager.[6] Imperva states that it may determine licensed volume using its rules and refers overage questions to separate overage and data-security volume policies.[8] Audit clauses in the five-part End User Agreement were not available for this article. Practitioners should obtain the current parts through their Thales contact and see software license audit and license compliance.
Out of scope
This overview does not cover Thales products outside software licensing for security, such as payment HSM hardware pricing, defence or aerospace businesses, or access management products other than SafeNet Trusted Access. It does not reproduce quotations, which Thales does not publish, and it does not describe the Thales Cyber Security Products End User Agreement parts, which could not be read.