A payment card number has a busy working life. It enters a terminal, passes through a gateway, meets a processor, and may return later to help settle a refund. Each stop needs enough information to do its job. Each stop can also become a place where a thief finds something worth taking. The awkward question is how to protect the number without making the whole procession stop.
- Voltage protects sensitive values while preserving formats that existing software can handle.
- Its customers include payment-software provider Epicor and financial-infrastructure operator SIX.
- The former HPE Security data business now lives within OpenText.
Epicor had a particularly practical version of that question. Its retail customers needed payment security, but the software serving them already had a job. A replacement gateway, a complicated integration, or an unsuitable charging model could turn an attractive security feature into an operating headache. Voltage’s opportunity was to make protection fit the machinery.
The number changes. The routine survives.
In OpenText’s published account, Epicor evaluated alternatives including TransArmor, Bluefin, and building encryption internally. It chose Voltage SecureData Payments, combining format-preserving encryption with Secure Stateless Tokenization. With Jumpstart implementation services, the company reports reaching production in seven weeks. Its gateway ran across six AWS availability zones in three regions.
“We wanted to license software and embed it into our offerings”Bill Wilson, Epicor - published customer account
That sentence explains a buying decision that a cipher specification cannot. Epicor wanted a commercial model compatible with its own product. The stateless approach also suited its distributed gateway: the case study describes consistent token schemes across regions without communication between them. Architecture and economics were pulling in the same direction.
A secret with the right dimensions
Ordinary software is full of assumptions. This column contains digits. That field has a fixed length. Two records with the same identifier belong together. Change those assumptions and a security project can become an application project, with a much larger cast of people and a much less agreeable timetable.
Format-preserving encryption addresses the shape problem. NIST’s 2016 recommendation describes methods for encrypting within a defined format. Think of a numeric identifier becoming another numeric identifier of the required length. The protected value can fit where the original fitted. That does not mean every calculation on the original will still work.
Tokenization replaces a sensitive value with a substitute. Depending on the design, applications can continue matching transactions without carrying the original value everywhere. Voltage’s approach combines these techniques with key management and access policy. The attraction is persistent protection as information moves between systems, rather than repeatedly exposing it at each handoff.
The basement before the payment terminal
Voltage began in 2002 with a different inconvenience: encrypted messaging was difficult to arrange. Stanford students Rishi Kacker, Matt Pauker, and Guido Appenzeller turned research into a business plan that won the university’s BASES competition against 59 other entries. The company initially worked from a Stanford basement.
Dan Boneh, also identified as a co-founder, and UC Davis researcher Matt Franklin supplied foundational identity-based encryption research. An identifier such as an email address could serve as a public key. The commercial promise was simpler key handling. A 2004 Stanford presentation already described a platform connecting communications applications to a common key-management infrastructure.
The business grew beyond messaging into protecting database and payment information. In October 2007, it announced a $12 million Series D led by Trident Capital. That funded product development, sales, and marketing. The recurring problem was recognizable across products: customers needed confidentiality without making ordinary work painfully complicated.
The migration is part of the product
One unnamed global logistics customer offers a useful corrective to the seven-week story. Its incumbent supplier announced an end-of-life for the tools it used. According to the published customer account, nearly three years of attempted disentanglement failed to produce the hoped-for result. Security was woven into the organization’s processes.
Consultation with its existing systems integrator and evaluation of alternatives led it to Voltage. The subsequent large-scale tokenization migration took 12 months. What changed the decision was the combination of technical fit, experience at scale, and help from a partner who understood the existing environment. The first thing to fail was the replacement effort, before the successful deployment began.
SIX presents another version of the integration challenge. Its published account describes protecting data in a Cloudera environment while retaining existing processes and applications, supported by implementation partner Prewen. The lesson for a buyer is concrete: include the people who understand the workflows, not only the people who understand the encryption.
Several owners. One persistent problem.
HP announced its acquisition of Voltage in February 2015 for an undisclosed sum. The technology joined its Atalla portfolio. HPE’s software business then merged into Micro Focus in September 2017. OpenText completed its acquisition of Micro Focus in January 2023. HPE Security is therefore a historical signpost for this business.
Today, OpenText sells SecureData Servers alongside payment protection, application interception, mainframe protection, and cloud integrations. A separate Voltage Data Security Platform finds and classifies sensitive information. Current buying routes include direct sales and cloud marketplaces. This is enterprise software bought around a deployment, not a consumer encryption app with a single checkout price.
Start with one field
Voltage does not own the idea of preserving formats. Protegrity also documents FF1-based protection. The useful comparison concerns integration effort, access controls, operating resilience, and commercial terms. Encryption that fits a field can still fail to fit a business if users need operations the protected values cannot support.
A sensible evaluation starts with one sensitive field and follows it through capture, processing, analytics, and recovery. Test the joins. Test the refund. Identify who must recover the original value. Measure the work as well as the throughput. Voltage’s history suggests that the detail worth copying is this attention to the journey. A secret still has places to go.