Overview
Mix (13 tools)
- License: 7 open source · 6 proprietary
- Hosting: 11 self-hosted · 2 SaaS · 0 both
Encryption protects data confidentiality by converting plaintext into ciphertext that can only be read with the correct decryption key. This directory covers data-at-rest encryption – specifically disk encryption, file/folder encryption, and endpoint encryption policy management for IT departments and MSPs.
Encryption platforms provide:
- Full Disk Encryption (FDE) – encrypts the entire disk (or partition) so that data is unreadable without authentication at boot; the primary defence against physical theft of laptops, servers, and removable media
- File / folder encryption – encrypts specific files or directories rather than the entire disk; useful for shared systems, cloud storage sync, and selective protection of sensitive data
- Removable media encryption – encrypts USB drives, external hard drives, and SD cards; prevents data loss from lost or stolen portable storage
- Centralised key management – enterprise console for managing encryption keys, escrowing recovery keys, and enforcing encryption policies across all endpoints
- Recovery key escrow – securely store recovery keys (BitLocker recovery keys, LUKS passphrases, FileVault recovery keys) so that IT can recover encrypted devices when users forget passwords or leave the organisation
- Compliance enforcement – verify that all endpoints are encrypted; report on encryption status; alert on non-compliant devices; required for HIPAA, PCI-DSS, GDPR, SOX, and most cyber insurance policies
- Pre-boot authentication (PBA) – require authentication (PIN, password, smart card, TPM) before the OS boots; prevents cold boot attacks and offline disk access
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Application-level encryption (e.g. OpenBAO transit) and Linux server disk encryption (LUKS) complement endpoint encryption (BitLocker, FileVault) managed via endpoint management / MDM platforms.
Deployment Model
| Tool | Platform | License |
|---|---|---|
| VeraCrypt | Win / macOS / Linux | Apache 2.0 |
| LUKS / dm-crypt | Linux | GPL-2.0 |
| Clevis / Tang | Linux | GPL-2.0 |
| Cryptomator | Win / macOS / Linux / mobile | GPL-3.0 |
| gocryptfs | Linux | MIT |
| age | Cross-platform (CLI) | BSD-3-Clause |
| GnuPG | Cross-platform | GPL-3.0 |
| BitLocker | Windows | Proprietary (OS) |
| FileVault | macOS | Proprietary (OS) |
| Sophos Device Enc. | Win / macOS (managed) | Proprietary |
| ESET FDE | Windows | Proprietary |
| Symantec Enc. | Win / macOS | Proprietary |
| Trend Micro Enc. | Windows | Proprietary |
Encryption Type
| Tool | FDE | Partition | File/Folder | Container | Removable |
|---|---|---|---|---|---|
| VeraCrypt | Yes | Yes | No | Yes | Yes |
| LUKS | Yes | Yes | No | No | Yes |
| BitLocker | Yes | Yes | No | No | Yes |
| FileVault | Yes | No | No | No | No |
| Cryptomator | No | No | Yes (vault) | Yes | No |
| gocryptfs | No | No | Yes (overlay) | No | No |
| age | No | No | Yes (file) | No | No |
| GnuPG | No | No | Yes (file) | No | No |
| Sophos | Yes* | No | No | No | No |
| ESET | Yes | No | No | No | Yes |
| Symantec | Yes | No | No | No | Yes |
* = manages BitLocker / FileVault, not own engine
Algorithm Support
| Tool | AES-256 | XTS | Serpent | Twofish | ChaCha20 |
|---|---|---|---|---|---|
| VeraCrypt | Yes | Yes | Yes | Yes | No |
| LUKS | Yes | Yes | Yes | Yes | No |
| BitLocker | Yes | Yes | No | No | No |
| FileVault | Yes | Yes | No | No | No |
| Cryptomator | Yes | No | No | No | No |
| age | No | No | No | No | Yes |
| GnuPG | Yes | No | No | Yes | No |
Centralised Management
| Tool | Web Console | Key Escrow | Policy Push | Compliance Reports |
|---|---|---|---|---|
| BitLocker + Intune | Yes | Yes (Azure AD) | Yes | Yes |
| BitLocker + SCCM | Yes | Yes (AD) | Yes | Yes |
| FileVault + MDM | Yes | Yes (MDM) | Yes | Yes |
| Sophos | Yes | Yes | Yes | Yes |
| ESET | Yes | Yes | Yes | Yes |
| Symantec | Yes | Yes | Yes | Yes |
| Trend Micro | Yes | Yes | Yes | Yes |
| VeraCrypt | No | No | No | No |
| LUKS | No | Manual | No | No |
| LUKS + Clevis/Tang | No | Network-bound | Ansible | No |
Pre-Boot Authentication
| Tool | PIN | Password | Smart Card | TPM-Only | Network |
|---|---|---|---|---|---|
| BitLocker | Yes | Yes | Yes | Yes | No |
| VeraCrypt | No | Yes | Yes | No | No |
| LUKS | No | Yes | Yes | No | No |
| LUKS + Clevis | No | No | No | No | Yes (Tang) |
| Symantec | Yes | Yes | Yes | Yes | No |
| Trend Micro | Yes | Yes | Yes | Yes | No |
| ESET | Yes | Yes | No | Yes | No |
| FileVault | No | Yes | No | N/A | No |
Authentik Integration
Encryption management consoles integrate with Authentik for admin SSO:
| Tool | OIDC | SAML | Notes |
|---|---|---|---|
| Sophos Central | No | Yes | SAML SSO |
| ESET Protect | No | No | AD/LDAP only |
| Intune | Yes | Yes | Entra ID native |
| Symantec | No | No | AD only |
Self-service recovery key portals can use Authentik forward-auth for identity verification.
Tools
13 tools.
age
age (pronounced “aghe”, from Actually Good Encryption) is a modern, simple file encryption tool designed as a replacement for GnuPG’s encryption functionality.
License: BSD-3-Clause (OSS) · Kind: cli · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
BitLocker + Intune / SCCM
BitLocker is Microsoft’s built-in full disk encryption feature for Windows. Available in Windows Pro, Enterprise, and Education editions, it encrypts entire volumes including the operating system drive.
License: Proprietary (proprietary) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
Clevis / Tang
Clevis and Tang provide network-bound disk encryption (NBDE) for Linux systems, enabling automated LUKS volume decryption when a machine is connected to its trusted network.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
Cryptomator
Cryptomator is an open-source client-side encryption tool designed specifically for protecting files stored in cloud sync services like Dropbox, Google Drive, OneDrive, and any WebDAV or S3-compatible storage.
License: GPL-3.0-only (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
ESET Full Disk Encryption
ESET Full Disk Encryption (EFDE) is an enterprise encryption solution managed through the ESET PROTECT console. On Windows, EFDE uses its own OPAL-based or software encryption engine with a custom pre-boot authentication screen.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
FileVault + MDM
FileVault is Apple’s built-in full disk encryption for macOS. FileVault 2 (introduced in OS X Lion) encrypts the entire startup volume using XTS-AES-128 encryption.
License: Proprietary (proprietary) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
GnuPG / GPG
GnuPG (GNU Privacy Guard) is the open-source implementation of the OpenPGP standard (RFC 9580). It provides encryption, decryption, and digital signing of files and communications.
License: GPL-3.0-only (OSS) · Kind: cli · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
gocryptfs
gocryptfs is a FUSE-based encrypted overlay filesystem for Linux. It encrypts files individually, storing ciphertext in a backing directory while presenting a plaintext view through a FUSE mount point.
License: MIT (OSS) · Kind: cli · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
LUKS / dm-crypt
LUKS (Linux Unified Key Setup) is the standard for Linux disk encryption, built on top of the kernel’s dm-crypt subsystem.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
Sophos Central Device Encryption
Sophos Central Device Encryption is a cloud-managed encryption solution that leverages the native OS encryption technologies – BitLocker on Windows and FileVault on macOS – while adding centralized management, recovery key escrow, complia…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Symantec Endpoint Encryption
Symantec Endpoint Encryption (SEE), now part of the Broadcom Symantec Enterprise portfolio, is a long-established enterprise encryption solution that provides full disk encryption, removable media encryption, and file/folder encryption.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Trend Micro Endpoint Encryption
Trend Micro Endpoint Encryption (TMEE) provides full disk encryption, file/folder encryption, and removable media encryption for Windows and macOS endpoints.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
VeraCrypt
VeraCrypt is a free, open-source disk encryption utility that succeeded TrueCrypt after its discontinuation in 2014.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
