How encryption works
Symmetric encryption uses one key to encrypt and to decrypt, and is fast enough for bulk data. Asymmetric encryption uses a pair: a public key that anyone may use to encrypt, and a private key that alone decrypts. Real systems combine them, using asymmetric keys to agree a temporary symmetric key for a session.
- In transit: between app, server and partner, so that a network in between cannot read the traffic
- At rest: databases, backups and files, so that a stolen disk is unreadable
- Field level: single values such as card numbers, encrypted before they reach the database
- End to end: from the customer's device to the one system allowed to read
What the standards say about encryption
PCI SSC's glossary describes strong cryptography as industry-tested and accepted algorithms with key lengths that provide a minimum of 112 bits of effective key strength, together with proper key-management practices. Some data may not be kept even encrypted: under PCI DSS, sensitive authentication data such as card security codes and PINs, after authorisation.
In the EU, the GDPR names encryption among the measures for the security of processing (Article 32). A personal data breach need not be communicated to the people affected where the data was unintelligible to anyone not authorised to access it, for example through encryption (Article 34).
Where the keys live
Keys are generated, stored and used in dedicated hardware: a hardware security module in a data centre, a secure element or a trusted execution environment in a phone. An encrypted database whose key sits in the same server's configuration file is protected against a lost disk and little else.
Encryption, hashing or tokenisation?
- Hashing
- A one-way transformation: the original cannot be recovered. Used to check passwords and to detect changes, not to store data that has to be read again.
- Tokenisation
- Replaces a value with a stand-in that has no mathematical link to it, and keeps the mapping in a vault. A token cannot be decrypted, only looked up.
Where encryption shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- BackofficeOne console to run the platform: customers, money, risk, content and staff permissions.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Glossary: Encryption, Strong Cryptography
- PCI SSC, FAQ 1533: storage of sensitive authentication data after authorisation
- Regulation (EU) 2016/679, GDPR, Articles 32 and 34 (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.