Alex Hanway | Director of Business Development
More About This Author >
Alex Hanway | Director of Business Development
More About This Author >
Enterprise data constantly moves across borders, clouds, and regulatory jurisdictions, carrying sensitive assets such as intellectual property, customer records, financial files, and healthcare information. At the same time, organizations must meet demanding requirements under frameworks including GDPR, HIPAA, and PCI-DSS.
In this environment, software-based encryption alone is not enough. True Zero Trust security requires data protection anchored in a hardware root of trust that keeps cryptographic keys isolated from software-based threats.
The reason is simple: encryption is only as strong as the protection surrounding its keys.
The Vulnerability of Software-Only Key Storage
Software-based encryption provides a necessary baseline, but encrypted data is only as secure as the keys protecting it. When master keys reside in software memory or on general-purpose servers, they can be exposed through external attacks, insider threats, or administrative compromise, undermining the entire encryption strategy.
For organizations operating in highly regulated sectors, hardware-backed key protection has transitioned from a security best practice to an absolute operational requirement. The central dilemma has been finding a way to implement hardware-grade key protection without sacrificing the speed, flexibility, and operational agility required to run a modern, multi-cloud enterprise.
When Data-Centric Security Meets Hardware-Backed Trust
Virtru and Thales address this gap by combining persistent, data-centric protection with hardware-backed key security.
What is Virtru’s Data-Centric Security?
Unlike traditional perimeter-based security, which tries to guard the network boundary, Virtru secures the data itself. Built on OpenTDF (an open-source standard evolved from technology developed at the NSA by Virtru co-founder Will Ackerly) and supporting the Five Eyes-ratified Zero Trust standard ACP 240, Virtru embeds access controls and security policies directly into data files.
The Virtru Data Security Platform provides a unified foundation for applying this protection across emails, files, SaaS applications, cloud repositories, and data workflows. It enables organizations to centrally manage access policies, key access, and audit activity while maintaining control of sensitive data across internal and external environments.
This ensures that wherever a file travels, whether it is sent via email, stored in a cloud repository, processed in an analytics pipeline, or shared with an external partner, it remains fully encrypted and governed by persistent, attribute-based access control (ABAC) policies.
The Virtru Data Security Platform extends Thales Luna HSMs' hardware security boundary into a persistent, object-level enforcement model.
The Thales Luna HSM Integration
Through the integration with Thales Luna HSMs, the master encryption keys protecting Virtru-secured data are generated, stored, and used within FIPS 140-3 Level 3-validated, tamper-resistant hardware. Keeping key operations inside the HSM reduces exposure to software-based attacks while preserving existing Virtru workflows.
Demystifying Deployment: Envelope Mode vs. Delegated Mode
The integration supports two deployment modes, allowing enterprises to balance operational flexibility with security and compliance requirements:
| Capability | Envelope Mode | Delegated Mode |
|---|---|---|
| Key Location | Root symmetric key remains inside the HSM; Virtru Key Access Service private keys are wrapped and stored in the Virtru platform database. | Virtru Key Access Service private keys never leave the physical boundary of the HSM. |
| Cryptographic Execution | Key wrapping and unwrapping occur inside the Virtru Key Access Service but are secured by AES-based symmetric cryptography using the HSM's root key. | All cryptographic operations (RSA key generation up to 4096-bit, data encryption key wrapping, and unwrapping) occur directly inside the HSM. |
| Operational Benefit | High operational flexibility and ease of management, backed by symmetric hardware security. | Maximum security assurance and compliance; zero exposure of key material outside the secure boundary. |
Choosing the right mode: Envelope Mode offers hardware-backed key protection with greater operational flexibility, while Delegated Mode keeps private keys and cryptographic operations entirely within the HSM for maximum security assurance.
Whichever mode an organization selects, the result is a consistent foundation for secure deployment across distributed environments.
Unlocking Global Scale, Multi-Cloud Agility, and Compliance
The joint Virtru and Thales solution not only protects data but also enables organizations to scale securely without encountering performance bottlenecks or cloud vendor lock-in.
- Multi-Cloud and Hybrid Freedom: Deploy Luna HSMs on-premises, in the cloud, as a service through Thales Data Protection on Demand, or in hybrid configurations to maintain consistent key protection and sovereign control across AWS, Microsoft Azure, Google Cloud, and private environments.
- Enterprise-Grade Scalability: Load-balanced, high-availability Luna HSM configurations support mission-critical workloads and continuous cryptographic services without disrupting operations.
- Meeting Global Compliance Mandates: FIPS 140-3 Level 3-validated key protection and persistent policy controls help demonstrate compliance with GDPR, HIPAA, PCI-DSS, SOC 2, and other industry regulations.
The Zero Trust Future Is Here
As sensitive data moves across clouds, borders, and collaborators, organizations need controls that travel with it. Virtru and Thales Luna HSMs provide that foundation by pairing persistent data policies with hardware-backed key protection, helping enterprises collaborate at scale while retaining control of their keys and data.