Marshall
Jones

The Problem That Wouldn't Go Away

Before VGS existed, Marshall Jones was at Balanced Payments - a startup that processed millions of dollars in marketplace transactions and kept the card data locked in its own vault. He built that vault. He understood, from direct experience, exactly how expensive and precarious it was to hold sensitive payment data: the audits, the compliance certifications, the sleepless nights before a PCI assessment, the attack surface that grew every time you added an engineer.

When Balanced was acquired by Stripe in 2015, most engineers would have collected their equity, taken a beach break, and figured out what came next. Jones and his co-founder Mahmoud Abdelkader had already figured it out. They had spent years watching the problem up close. They knew the question was not "how do you secure sensitive data better?" It was "how do you stop businesses from touching it in the first place?"

The architecture is deceptively simple: intercept sensitive data at the edge, swap it for a token, pass the token through the merchant's systems as if nothing happened. The merchant sees tokens everywhere. The real data lives in VGS's vault. When a payment needs to be processed, VGS detokenizes it for the card network - invisibly, in milliseconds. The merchant never had the data. They can't be breached for data they never held.

Building the World's Most Trusted Vault

Jones brought this idea to market in 2015 out of San Francisco, and spent the next several years making it enterprise-grade. The technical work was formidable. VGS needed to achieve PCI-DSS compliance - the financial industry's gold standard for payment security - and SOC 2 certification, and HIPAA compliance, and GDPR, and CCPA. Each of those certifications required building infrastructure that could satisfy regulators, auditors, and the security teams at Fortune 500 companies who were used to doing this themselves.

By 2018, VGS had PCI-DSS 3.2 certification and an $8.5 million Series A led by Andreessen Horowitz - with participation from NYCA, Vertex Ventures, Slow Ventures, and notably Max Levchin, the PayPal co-founder who knows payment infrastructure as well as anyone alive. Andreessen Horowitz doesn't write fintech security checks lightly. The team understood what Jones had built.

Goldman Sachs followed in 2019 with a $35 million Series B. The institutional signal was clear: this was not a niche compliance tool. It was foundational infrastructure. Then in December 2020, Vertex Ventures US led a $60 million Series C alongside Andreessen Horowitz and Goldman Sachs. Total capital raised crossed $104 million.

Five Billion Tokens, and Counting

In May 2024, VGS crossed three billion tokens stored. By 2025 - ten years after Jones and Abdelkader founded the company - that number had surpassed five billion. To put that in context: five billion payment credential records, sitting safely in VGS's vault instead of inside the systems of the merchants who processed them. Five billion potential breach events that didn't happen.

The company now serves Fortune 500 corporations, banks, merchants, and fintechs across the globe. Visa - the largest payment network on earth - made a strategic investment and formed a Fintech Partner Connect relationship with VGS. That partnership, expanded in April 2025, gives VGS access to Visa's network and signals that the payment rails are increasingly comfortable routing sensitive credential flows through the VGS infrastructure layer.

Before the Vault, There Was the Podcast

In October 2013, Jones appeared on the Changelog podcast to talk about Balanced Payments and open sourcing. It's a window into how he thinks. Even then, before VGS, he was preoccupied with the structural problems in payment infrastructure - the way compliance requirements pushed costs onto merchants who had no good reason to be in the business of securing payment data, the way open-source transparency could build trust in financial systems, the way engineering culture at a fintech had to be different from engineering culture at a social app.

Jones studied at Massey University in New Zealand before making his way to Silicon Valley. His Product Hunt handle - @mjallday - tells you something about the pace. He codes. He ships. He leads a 460-person engineering organization with the same builder reflex that got him onto a Changelog episode in 2013 discussing payment infrastructure with the kind of specificity most engineers reserve for their own codebases.

The Technical Stack That Powers Modern Payments

VGS's platform in 2025 handles a daunting range of use cases: payment tokenization, network tokens (issued directly through Visa and Mastercard), 3D Secure authentication, account updater services, credential vault management, multi-PSP routing, card lifecycle management, and API-driven access to the entire ecosystem. Jones launched a new vault deployment in Singapore in summer 2025 to support Asia Pacific expansion.

The technology stack VGS operates for its clients includes Salesforce, AWS, Marketo, Google Cloud infrastructure, Atlassian tooling, Zapier integrations, and a custom-built tokenization engine that sits at the edge of client payment flows. The engineering challenge is not just security - it's latency. A tokenization proxy that adds meaningful delay to a payment flow is a proxy that merchants won't use. Jones's team has spent a decade optimizing the intercept-substitute-return cycle to be effectively invisible in production.

Recognition Without the Noise

In 2022, Marshall Jones was named to the Top 25 Financial Technology CTOs list. In 2025, VGS appeared in the "50 American Leaders" documentary series. The company made CNBC and Statista's ranking of the world's top fintech companies. These are not the kinds of recognitions that come with keynote slots at consumer tech conferences. They are the kind that come from a decade of doing extremely hard work extremely well for clients who would notice immediately if anything went wrong.

That's the profile Jones has built: essential, invisible, trusted. The vault that Fortune 500 security teams choose not because it's the most marketed option, but because they can't afford to be wrong.