Last updated
SOLUTION 02
DATA PRIVACY & PROTECTION
Protection at the edge means encrypting, masking and tokenising sensitive data as it leaves its source system, before it reaches any downstream platform. CCA applies format-preserving encryption and policy-driven controls across hybrid environments, so data stays governed and usable whether it sits on legacy systems, in transit, or in the cloud.
Trapped Between Two Incomplete Approaches
Downstream Controls Are Fragile. Perimeters Aren’t Enough.
The choice: Protect at the Destination
What it means: Apply security controls only after data has already arrived in downstream systems, analytics platforms or the cloud.
Why it fails
Destination-Only Encryption
- Leaves a real exposure window between creation and control
- Forces every downstream tool to enforce its own protection
- Creates inconsistent controls across hybrid environments
- Widens the gap between source and destination compliance
The choice: Rely on the Perimeter
What it means: Depend on network and perimeter security alone, and hope sensitive data is never exposed while it’s in transit.
Why it fails
Perimeter-Only Security
- Assumes the breach will never reach the data itself
- Does nothing to reduce insider or credential-based risk
- One breach exposes data in full, unprotected form
- Provides no lineage or audit trail once data has moved
A Protected-by-Design Data Strategy
CCA and OpenText embed encryption, masking and tokenisation at the point data is unlocked - so sensitive fields are already protected before they ever reach a modern platform.
Protection at the Source, Not the Destination
Security starts where data is created, eliminating the risk window between creation and downstream controls.
Shift-left security embeds encryption, masking and policy enforcement into the replication pipeline itself, by design.
Significantly Reduces Exposure Risk
- Eliminates the gap between data creation and protection
- Removes reliance on multiple downstream tools to “fix” exposed data
- Supports zero-trust data flows across every environment
- Enables safe consumption for cloud, AI and analytics platforms
Protected Data, End to End
Trusted, policy-enforced protection from the moment data leaves the source system.
Source System
Mainframe / legacy platform
Encrypt & Tokenise
At the point of origin
Modern Platforms
Cloud, analytics, AI
Purpose-Built Components, Working as One
OpenText Voltage Data Security Platform (DSP)
Discovers and automatically classifies structured data assets - what exists, where it resides, and how it should be governed.
Rocket Data Replicate and Sync (RDRS)
Real-time change data capture and synchronisation across legacy and modern environments, as changes occur.
CCA Secure Data Connector
Integrates real-time replication with protection services so sensitive data stays protected throughout synchronisation.
OpenText Voltage SecureData
Encryption, format-preserving encryption, tokenisation and policy-driven controls - without impacting usability.
What the Solution Delivers
Format-Preserving Encryption
Protects structured data without breaking downstream applications or workflows.
Tokenisation for Analytics & AI
Lets teams work with data safely, without ever exposing the raw sensitive values.
Zero-Trust Data Flows
Treats every movement of data as a risk to be controlled, not assumed safe.
Consistent Policy Enforcement
Applies the same governance across mainframe, distributed and cloud environments.
Outcomes That Matter to the Business
Protect Data Before It Moves
Enable Safe Analytics & AI Consumption
Reduce Downstream Tooling & Complexity
Support Zero-Trust Architecture
Simplify Compliance & Audit
Frequently asked questions
What does protection at the edge mean?
It means encrypting, masking and tokenising sensitive data as it leaves its source system, before it reaches any downstream platform. Protection is embedded at the point data is unlocked, so sensitive fields are already protected before they arrive in cloud, analytics or AI platforms.
How is this different from protecting data at the destination?
Destination controls act only after data has already travelled, which leaves a risk window between creation and the downstream control. Protecting at the source starts where data is created and removes that window, rather than relying on controls applied further down the pipeline.
Will adding encryption and masking break our downstream applications?
It is designed not to. Protection uses format-preserving encryption, masking and tokenisation so structured data is protected without breaking downstream applications or workflows, and teams can work with data without ever exposing the raw sensitive values.
Where in the data flow does protection actually apply?
Inside the replication pipeline itself, by design. Shift-left security embeds encryption, masking and policy enforcement into the replication path, so protection is applied at the point of origin as data moves from mainframe and legacy platforms to cloud, analytics and AI.
Which components deliver edge protection?
Four purpose-built components work together: OpenText Voltage Data Security Platform discovers and classifies structured data; Rocket Data Replicate and Sync provides real-time change data capture; CCA Secure Data Connector integrates replication with protection services; and OpenText Voltage SecureData applies encryption, format-preserving encryption, tokenisation and policy-driven controls.
What risk does protection at the edge reduce?
It reduces exposure risk by treating every movement of data as a risk to be controlled, and by removing the gap in which data exists unprotected between its source system and the platforms that consume it. Policy-enforced protection applies from the moment data leaves the source.
See what protected-by-design data makes possible for your organisation.
Talk to a consultant about embedding encryption and tokenisation into your data pipelines.
Talk to a consultant
