Virtru launches OpenTDF project to offer orgs zero-trust data controls 

Today, data protection provider Virtru announced the launch of the OpenTDF project, an open-source initiative that publicly releases the Trusted Data Format (TDF) specification originally developed at the National Security Agency, to enable developers to encrypt data entering and leaving applications, and to apply zero-trust controls at the data layer. 

Outside of the OpenTDF project, Virtru provides a data encryption solution that encrypts data processed and shared by email apps, file sharing platforms, SaaS apps and cloud services, and maintains integrations for Google Workspace, Microsoft 365, Salesforce and Zendesk.

By launching OpenTDF, Virtru aims to allow developers to use software development kits on the OpenTDF GitHub repo to build applications that are better prepared to secure sensitive data, protect personal health information, cryptographically enforce document redaction and protect message content end-to-end. 

Protecting digital data borders 

The release comes as more organizations are struggling to keep up with implementing data access controls, with 90% of organizations reporting that they struggle with enforcing security policies around sensitive or critical data. 

Part of the reason for this challenge is that modern data doesn’t just sit on the endpoint, but travels through a complex of third-party providers, services and apps.  

OpenTDF is designed to address this challenge head-on by providing protection at the data layer, securing sensitive information with object-level encryption and granular policy controls. 

“TDF was created to address gaps in secure information sharing between U.S. federal government agencies. Today, TDF is used by thousands of organizations, including the U.S. Intelligence Community, to enable secure sharing with platform-agnostic encryption for any type of data, across any cloud environment or device, using persistent access controls that ensure data privacy,” said senior vice president of Virtru, Matt Howard. 

“With OpenTDF, organizations can incorporate these industry-leading data-control standards into their applications, as well as customize their own encrypted data flows. There are no back doors and no third-party access requirements,” Howard said. 

TDF is a unique solution in the market due to its ability to wrap data objects in an extra layer of security, so the data owner can protect it even when it’s not in their possession. This means they can protect information traversing through internal systems as well as those of third parties, as part of a zero-trust data control (ZTDC) approach. 

The data encryption market 

Virtru is part of the encryption software market, which researchers valued at $10.9 billion in 2021, and anticipate will reach $22.1 billion by 2026 as organizations invest heavily in solutions to manage data under the burden of growing data privacy regulations. 

Since its formation in 2012, the company’s position in the market has been quite strong, with Virtru announcing it had raised $60 million as part of a series C funding round at the start of this year, and painting a customer base of over 7,000. The organization reportedly protects almost 2 million emails and files a day. 

Virtru competes against a number of other encryption and protection providers, including Zix, an automatic email encryption and data-loss prevention solution that scans and automatically encrypts emails with sensitive information, and quarantines messages that violate control policies. OpenText acquired Zix last year for $860 million. 

Another competitor is ProtonMail, an encrypted email service based in Switzerland that uses open-source end-to-end encryption and zero-access encryption to ensure only the intended user can access the emails in their inbox. ProtonMail protects over 50 million users globally.

However, Howard argues that Virtru is unique from other data protection providers because it provides policy and access controls for data flowing in and out of organizations via email, files and other apps, so enterprises can “expand their zero-trust security strategies beyond identities, endpoints and networks.”