lee.potok@thal…
Wed, 10/14/2026 – 09:44
Virtru and Thales combine persistent data-centric security with Thales Luna HSMs to protect sensitive information wherever it travels. By keeping encryption keys protected in tamper-resistant hardware and applying access policies directly to data, the solution helps organizations collaborate across cloud and hybrid environments while supporting security and compliance requirements.
Data Security
Encryption Key Management
Alex Hanway | Director of Business Development
More About This Author >
Enterprise data constantly moves across borders, clouds, and regulatory jurisdictions, carrying sensitive assets such as intellectual property, customer records, financial files, and healthcare information. At the same time, organizations must meet demanding requirements under frameworks including GDPR, HIPAA, and PCI-DSS.
In this environment, software-based encryption alone is not enough. True Zero Trust security requires data protection anchored in a hardware root of trust that keeps cryptographic keys isolated from software-based threats.
The reason is simple: encryption is only as strong as the protection surrounding its keys.
The Vulnerability of Software-Only Key Storage
Software-based encryption provides a necessary baseline, but encrypted data is only as secure as the keys protecting it. When master keys reside in software memory or on general-purpose servers, they can be exposed through external attacks, insider threats, or administrative compromise, undermining the entire encryption strategy.
For organizations operating in highly regulated sectors, hardware-backed key protection has transitioned from a security best practice to an absolute operational requirement. The central dilemma has been finding a way to implement hardware-grade key protection without sacrificing the speed, flexibility, and operational agility required to run a modern, multi-cloud enterprise.
When Data-Centric Security Meets Hardware-Backed Trust
Virtru and Thales address this gap by combining persistent, data-centric protection with hardware-backed key security.
What is Virtru’s Data-Centric Security?
Unlike traditional perimeter-based security, which tries to guard the network boundary, Virtru secures the data itself. Built on OpenTDF (an open-source standard evolved from technology developed at the NSA by Virtru co-founder Will Ackerly) and supporting the Five Eyes-ratified Zero Trust standard ACP 240, Virtru embeds access controls and security policies directly into data files.
The Virtru Data Security Platform provides a unified foundation for applying this protection across emails, files, SaaS applications, cloud repositories, and data workflows. It enables organizations to centrally manage access policies, key access, and audit activity while maintaining control of sensitive data across internal and external environments.
This ensures that wherever a file travels, whether it is sent via email, stored in a cloud repository, processed in an analytics pipeline, or shared with an external partner, it remains fully encrypted and governed by persistent, attribute-based access control (ABAC) policies.
The Virtru Data Security Platform extends Thales Luna HSMs' hardware security boundary into a persistent, object-level enforcement model.
The Thales Luna HSM Integration
Through the integration with Thales Luna HSMs, the master encryption keys protecting Virtru-secured data are generated, stored, and used within FIPS 140-3 Level 3-validated, tamper-resistant hardware. Keeping key operations inside the HSM reduces exposure to software-based attacks while preserving existing Virtru workflows.
Demystifying Deployment: Envelope Mode vs. Delegated Mode
The integration supports two deployment modes, allowing enterprises to balance operational flexibility with security and compliance requirements:
CapabilityEnvelope ModeDelegated ModeKey LocationRoot symmetric key remains inside the HSM; Virtru Key Access Service private keys are wrapped and stored in the Virtru platform database.Virtru Key Access Service private keys never leave the physical boundary of the HSM.Cryptographic ExecutionKey wrapping and unwrapping occur inside the Virtru Key Access Service but are secured by AES-based symmetric cryptography using the HSM's root key.All cryptographic operations (RSA key generation up to 4096-bit, data encryption key wrapping, and unwrapping) occur directly inside the HSM.Operational BenefitHigh operational
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: