Vaultive announced Vaultive for Hosted Exchange, a cloud data encryption solution that enables customers to encrypt data-at-rest and data-in-use within the Hosted Microsoft Exchange environment, while enterprise IT retains complete control of the encryption keys.

“Moving a vital application such as email to a cloud environment has the potential to save an enterprise a significant amount of time, resources and money, but security, data residency, privacy and regulatory compliance concerns are often barriers,” said Steve Coplan, research manager for 451 Research's Enterprise Security Practice.

“In order to take advantage of the operational benefits of a cloud-based service without ceding the ability to manage access to data and emails residing on third-party infrastructure, a best practice is to require some mechanism to internally retain controls. Vaultive's approach allows organizations to encrypt data-at-rest in the cloud, while holding the keys to decrypt the data," Coplan added.

Vaultive is the only solution developed specifically for Hosted Exchange environments, including Microsoft Office 365, that encrypts data-at-rest and data-in-use. Vaultive uses a patent-pending form of 256-bit AES encryption that preserves certain characteristics of the data so it can be searched, sorted, indexed, and otherwise processed in the cloud without ever being decrypted.

Vaultive’s application of AES protects enterprise data from unauthorized access by a third party or the cloud provider, while enabling disclosure requests to be managed independently by the enterprise - without placing the cloud provider in the position of disclosing customer data.

“We were not willing to put our data or our clients’ data in the cloud without Vaultive,” said Chris Brody, senior managing director and president of Stillwater, LLC. “Microsoft and other cloud providers may be required to turn our data over to the government if subpoenaed, including data subject to attorney-client privilege. By using Vaultive for Hosted Exchange, when the government wants our data, they need to come to us, not the cloud provider.”

Additionally, because sensitive data never resides in the cloud in an unencrypted form, security risks and concerns about data residency are eliminated, while compliance with regulatory requirements such as SOX, GLBA, HIPAA, HITECH and PCI-DSS is achieved.