License & Deployment Mix: 13 tools – 7 OSS, 2 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
Encryption protects data confidentiality by converting plaintext into ciphertext that can only be read with the correct decryption key. This directory covers data-at-rest encryption – specifically disk encryption, file/folder encryption, and endpoint encryption policy management for IT departments and MSPs.
Encryption platforms provide:
- Full Disk Encryption (FDE) – encrypts the entire disk (or partition) so that data is unreadable without authentication at boot; the primary defence against physical theft of laptops, servers, and removable media
- File / folder encryption – encrypts specific files or directories rather than the entire disk; useful for shared systems, cloud storage sync, and selective protection of sensitive data
- Removable media encryption – encrypts USB drives, external hard drives, and SD cards; prevents data loss from lost or stolen portable storage
- Centralised key management – enterprise console for managing encryption keys, escrowing recovery keys, and enforcing encryption policies across all endpoints
- Recovery key escrow – securely store recovery keys (BitLocker recovery keys, LUKS passphrases, FileVault recovery keys) so that IT can recover encrypted devices when users forget passwords or leave the organisation
- Compliance enforcement – verify that all endpoints are encrypted; report on encryption status; alert on non-compliant devices; required for HIPAA, PCI-DSS, GDPR, SOX, and most cyber insurance policies
- Pre-boot authentication (PBA) – require authentication (PIN, password, smart card, TPM) before the OS boots; prevents cold boot attacks and offline disk access
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Application-level encryption (e.g. OpenBAO transit) and Linux server disk encryption (LUKS) complement endpoint encryption (BitLocker, FileVault) managed via endpoint management / MDM platforms.
Deployment Model
| Tool | Platform | License |
|---|---|---|
| VeraCrypt | Win / macOS / Linux | Apache 2.0 |
| LUKS / dm-crypt | Linux | GPL-2.0 |
| Clevis / Tang | Linux | GPL-2.0 |
| Cryptomator | Win / macOS / Linux / mobile | GPL-3.0 |
| gocryptfs | Linux | MIT |
| age | Cross-platform (CLI) | BSD-3-Clause |
| GnuPG | Cross-platform | GPL-3.0 |
| BitLocker | Windows | Proprietary (OS) |
| FileVault | macOS | Proprietary (OS) |
| Sophos Device Enc. | Win / macOS (managed) | Proprietary |
| ESET FDE | Windows | Proprietary |
| Symantec Enc. | Win / macOS | Proprietary |
| Trend Micro Enc. | Windows | Proprietary |
Encryption Type
| Tool | FDE | Partition | File/Folder | Container | Removable |
|---|---|---|---|---|---|
| VeraCrypt | Yes | Yes | No | Yes | Yes |
| LUKS | Yes | Yes | No | No | Yes |
| BitLocker | Yes | Yes | No | No | Yes |
| FileVault | Yes | No | No | No | No |
| Cryptomator | No | No | Yes (vault) | Yes | No |
| gocryptfs | No | No | Yes (overlay) | No | No |
| age | No | No | Yes (file) | No | No |
| GnuPG | No | No | Yes (file) | No | No |
| Sophos | Yes* | No | No | No | No |
| ESET | Yes | No | No | No | Yes |
| Symantec | Yes | No | No | No | Yes |
* = manages BitLocker / FileVault, not own engine
Algorithm Support
| Tool | AES-256 | XTS | Serpent | Twofish | ChaCha20 |
|---|---|---|---|---|---|
| VeraCrypt | Yes | Yes | Yes | Yes | No |
| LUKS | Yes | Yes | Yes | Yes | No |
| BitLocker | Yes | Yes | No | No | No |
| FileVault | Yes | Yes | No | No | No |
| Cryptomator | Yes | No | No | No | No |
| age | No | No | No | No | Yes |
| GnuPG | Yes | No | No | Yes | No |
Centralised Management
| Tool | Web Console | Key Escrow | Policy Push | Compliance Reports |
|---|---|---|---|---|
| BitLocker + Intune | Yes | Yes (Azure AD) | Yes | Yes |
| BitLocker + SCCM | Yes | Yes (AD) | Yes | Yes |
| FileVault + MDM | Yes | Yes (MDM) | Yes | Yes |
| Sophos | Yes | Yes | Yes | Yes |
| ESET | Yes | Yes | Yes | Yes |
| Symantec | Yes | Yes | Yes | Yes |
| Trend Micro | Yes | Yes | Yes | Yes |
| VeraCrypt | No | No | No | No |
| LUKS | No | Manual | No | No |
| LUKS + Clevis/Tang | No | Network-bound | Ansible | No |
Pre-Boot Authentication
| Tool | PIN | Password | Smart Card | TPM-Only | Network |
|---|---|---|---|---|---|
| BitLocker | Yes | Yes | Yes | Yes | No |
| VeraCrypt | No | Yes | Yes | No | No |
| LUKS | No | Yes | Yes | No | No |
| LUKS + Clevis | No | No | No | No | Yes (Tang) |
| Symantec | Yes | Yes | Yes | Yes | No |
| Trend Micro | Yes | Yes | Yes | Yes | No |
| ESET | Yes | Yes | No | Yes | No |
| FileVault | No | Yes | No | N/A | No |
Authentik Integration
Encryption management consoles integrate with Authentik for admin SSO:
| Tool | OIDC | SAML | Notes |
|---|---|---|---|
| Sophos Central | No | Yes | SAML SSO |
| ESET Protect | No | No | AD/LDAP only |
| Intune | Yes | Yes | Entra ID native |
| Symantec | No | No | AD only |
Self-service recovery key portals can use Authentik forward-auth for identity verification.
Tools
13 tools.
age
age (pronounced “aghe”, from Actually Good Encryption) is a modern, simple file encryption tool designed as a replacement for GnuPG’s encryption functionality.
License: BSD-3-Clause (OSS) · Kind: cli · Deploy: native · SSO: none
BitLocker + Intune / SCCM
BitLocker is Microsoft’s built-in full disk encryption feature for Windows. Available in Windows Pro, Enterprise, and Education editions, it encrypts entire volumes including the operating system drive.
License: Proprietary (proprietary) · Kind: service · Deploy: native · SSO: none
Clevis / Tang
Clevis and Tang provide network-bound disk encryption (NBDE) for Linux systems, enabling automated LUKS volume decryption when a machine is connected to its trusted network.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: native · SSO: none
Cryptomator
Cryptomator is an open-source client-side encryption tool designed specifically for protecting files stored in cloud sync services like Dropbox, Google Drive, OneDrive, and any WebDAV or S3-compatible storage.
License: GPL-3.0-only (OSS) · Kind: desktop · Deploy: native · SSO: none
ESET Full Disk Encryption
ESET Full Disk Encryption (EFDE) is an enterprise encryption solution managed through the ESET PROTECT console. On Windows, EFDE uses its own OPAL-based or software encryption engine with a custom pre-boot authentication screen.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
FileVault + MDM
FileVault is Apple’s built-in full disk encryption for macOS. FileVault 2 (introduced in OS X Lion) encrypts the entire startup volume using XTS-AES-128 encryption.
License: Proprietary (proprietary) · Kind: service · Deploy: native · SSO: none
GnuPG / GPG
GnuPG (GNU Privacy Guard) is the open-source implementation of the OpenPGP standard (RFC 9580). It provides encryption, decryption, and digital signing of files and communications.
License: GPL-3.0-only (OSS) · Kind: cli · Deploy: native · SSO: none
gocryptfs
gocryptfs is a FUSE-based encrypted overlay filesystem for Linux. It encrypts files individually, storing ciphertext in a backing directory while presenting a plaintext view through a FUSE mount point.
License: MIT (OSS) · Kind: cli · Deploy: native · SSO: none
LUKS / dm-crypt
LUKS (Linux Unified Key Setup) is the standard for Linux disk encryption, built on top of the kernel’s dm-crypt subsystem.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: native · SSO: none
Sophos Central Device Encryption
Sophos Central Device Encryption is a cloud-managed encryption solution that leverages the native OS encryption technologies – BitLocker on Windows and FileVault on macOS – while adding centralized management, recovery key escrow, complia…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Symantec Endpoint Encryption
Symantec Endpoint Encryption (SEE), now part of the Broadcom Symantec Enterprise portfolio, is a long-established enterprise encryption solution that provides full disk encryption, removable media encryption, and file/folder encryption.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Trend Micro Endpoint Encryption
Trend Micro Endpoint Encryption (TMEE) provides full disk encryption, file/folder encryption, and removable media encryption for Windows and macOS endpoints.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
VeraCrypt
VeraCrypt is a free, open-source disk encryption utility that succeeded TrueCrypt after its discontinuation in 2014.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: native · SSO: none
