Protegrity & Informatica
overview
For data engineering teams processing millions of records, security cannot come at the cost of latency. Protegrity delivers high-velocity data protection for Informatica by running cryptographic operations in-process via Java Transformations (JTX) for PowerCenter, effectively eliminating network overhead. For cloud-native workflows in IICS, the solution scales elastically using serverless functions. This dual approach allows you to apply consistent privacy policies across your entire data estate, ensuring that massive datasets are tokenized and compliant before they are ever written to your target data warehouse.
Key Integration Features
Protegrity delivers a high-performance security layer designed specifically for the rigorous demands of Informatica’s enterprise data engineering. Unlike standard API-based solutions, Protegrity can embed protection logic directly into the Informatica PowerCenter processing engine via Java Transformations (JTX), eliminating network latency for massive on-premise workloads. Simultaneously, it extends this governance to Informatica Intelligent Cloud Services (IICS), ensuring a unified security posture. This page outlines how Protegrity enables data teams to secure millions of records in minutes, maintaining the velocity required for modern data warehousing and cloud migration.
Features & Capabilities
Protegrity integrates with Informatica PowerCenter and IICS to deliver high-velocity, hybrid data protection:
01
Zero-Latency “In-Process” Protection
Why It Matters
Maximize throughput for massive on-premise workloads by running protection logic directly on the Informatica server. Unlike standard API calls that incur network overhead, Protegrity integrates via Java Transformations (JTX) within the PowerCenter pipeline, allowing cryptographic operations to execute locally in memory for blazing-fast performance.
How it Works
A telecom operator processes 500 million Call Detail Records (CDRs) daily. By using Protegrity’s local Java protector within their PowerCenter mappings, they achieved a throughput of over 100,000 records per second, eliminating the bottlenecks associated with external REST calls.
02
Hybrid Cloud Interoperability (PowerCenter & IICS)
Why It Matters
Future-proof your data strategy with a security layer that spans generations of infrastructure. Policies applied in legacy on-premise PowerCenter workflows are fully compatible with modern Informatica Intelligent Cloud Services (IICS) flows, ensuring seamless data mobility during cloud migrations without requiring re-encryption.
How it Works
A retail bank uses PowerCenter to protect sensitive customer data on-premise before migrating it to Snowflake. Once in the cloud, new IICS workflows (connected to Protegrity Cloud Protect) can seamlessly process that same data, ensuring a secure, uninterrupted chain of custody during their multi-year cloud journey.
03
Schema-Preserving Tokenization
Why It Matters
Maintain absolute data integrity across diverse target systems. Protegrity’s vaultless tokenization preserves the original data type and length (e.g., keeping a 16-digit credit card number as 16 digits), ensuring that protected data loads successfully into target data warehouses without triggering schema validation errors or requiring column resizing.
How it Works
When loading data from a mainframe into a strict SQL database, a mismatch in field length often causes ETL failures. Protegrity ensures the tokenized output mirrors the source format exactly, allowing the Informatica mapping to run successfully without complex validation logic or exception handling.
04
Decoupled Policy Governance
Why It Matters
Abstract security logic away from ETL development. Instead of hardcoding encryption rules inside Informatica Mapplets, the integration calls a named policy (e.g., “Policy_HR_Global”) managed centrally in the Protegrity Enterprise Security Administrator (ESA). This allows security teams to update algorithms or rotation schedules without forcing data engineers to modify and redeploy critical ETL jobs.
How it Works
A multinational insurer needed to update their encryption standard from AES-128 to AES-256 to meet new compliance mandates. They updated the policy in Protegrity ESA, and thousands of Informatica mappings instantly adhered to the new standard on their next run—zero code changes required.
05
Granular Separation of Duties
Why It Matters
Enforce a strict boundary between data engineering and security operations. The Informatica developer places the protection transformation into the workflow but never has access to the encryption keys or the ability to see clear-text data. This satisfies strict “Separation of Duties” compliance requirements common in banking and healthcare.
How it Works
During a compliance audit, a financial services firm demonstrated that while their ETL developers had full administrative access to the Informatica environment, they were technically incapable of reversing the tokenization because the unprotect rights were restricted solely to specific authorized service accounts managed by the CISO’s office.
Architecture &
Sample Data Flow
Protegrity can be incorporated at different points in an Informatica architecture depending on where sensitive data should transition into or out of a protected state. PowerCenter can apply protection during on-premises ETL processing, while cloud data-integration workflows can connect to Protegrity protection capabilities within the appropriate cloud or hybrid architecture.
The data journey
Visualizing the data journey
The data journey
The data journey explained
-
01
Protect at the Source
Sensitive fields can be tokenized or encrypted within Informatica PowerCenter before data leaves the on-premises processing environment. This establishes a protected state early in the pipeline and reduces the need to move clear sensitive data into downstream cloud or analytics systems.
-
02
Process and Move Protected Data
Informatica continues to transform, route, and load the data according to the workflow design. Protected values can move between on-premises systems, cloud environments, warehouses, and analytics platforms while Protegrity policy remains responsible for how sensitive fields are protected.
-
03
Land Data Protected
Sensitive values can remain protected when written to downstream destinations such as cloud data warehouses or data lakes. This extends protection beyond the Informatica pipeline rather than automatically returning data to clear form at the end of the ETL process.
-
04
Unprotect by Policy
When an approved application, service, or user requires access to original values, controlled unprotection can occur at the appropriate point in the Informatica workflow or destination environment. Protegrity policy determines when access to clear data is permitted.
DEPLOYMENT
Protegrity can be incorporated into Informatica architectures spanning PowerCenter, cloud data-integration workflows, and hybrid environments. The appropriate deployment model depends on where Informatica processing occurs, where sensitive data should first be protected, and which Protegrity protection capabilities are available within the environment.
PowerCenter
Cloud Data Integration
Hybrid Environments
Deployment Considerations
Deployment planning should account for:
- Where sensitive data first enters the Informatica workflow
- Where protection and controlled unprotection should occur
- Connectivity between Informatica processing environments and Protegrity protection services
- Data volume and workload concurrency
- Schema and format requirements for protected values
- Identity and policy requirements for authorized access to clear data
- Performance requirements for batch and real-time workloads
Representative workloads should be tested and sized according to the organization’s Informatica architecture and protection requirements.
RESOURCES
Explore Protegrity documentation and technical resources for implementing and managing data protection across Informatica workflows.
Protegrity Documentation Center
Explore technical documentation for Protegrity data protection, policy management, protectors, deployment, and platform capabilities.
READ MORE