PK Protect

for Use with z/OS

With as much as 80 percent of the world’s data processed on mainframes, the IBM z/OS platform is an essential part of over 70 percent of the Fortune 500’s IT infrastructure strategies.

See a Demo

Advanced Capabilities for IBM Z Hardware and z/OS

While IBM’s Pervasive Encryption® provides good protection for the data at rest, security gaps can emerge when the data is copied or moved to another system or location. PK Protect for use with z/OS works with and extends that protection, regardless of the target platform, keeping sensitive data persistently private and secure.


PK Protect for use with z/OS features support for the latest IBM Z and z/OS, cashing in on improved DFSMS Cloud management, z/ACS, z/OSMF, and enhanced symbiosis with IBM Pervasive Encryption®.

Ongoing Protection

While IBM Z may be the most secure platform available, data never rests or stays in once place. PK Protect’s persistent encryption keeps data safe from theft or misuse even when it leaves IBM Z.


Smaller File Size

From the inventors of the ZIP file format and enterprise-grade data compression, our industry-best technology compresses files, reducing them as much as 95 percent.


zIIP Support

Processing can be offloaded to an IBM
Z Integrated Information Processor for fewer GP cycles.


zEDC Support

Offload software data compression processing to the zEDC to reduce demands on other system resources.


HSM Integration

Synchronize symmetric and asymmetric keys with internal and external HSMs.


Application Layer Encryption

Programmatically apply Field Level Encryption within application buffers with the PKZAPIO.

z/OS Functionality

Free up resources for other tasks. PK Protect keeps sensitive data secure while reducing demands on IBM Z resources and streamlining mainframe workflows. All in addition to reducing encryption overhead to 5 percent or less.

Smart and Easy

Quickly secure files and data without application changes, additional infrastructure, or professional services, and all without disrupting existing workflows. Sensitive data remains safe even when it’s sent outside of the mainframe environment.


Whether it is Big Data or Big Iron, PK Discover can scan and discover structured and unstructured data on z/OS, searching for sensitive information that may be out of compliance. Db2®, Informix®, Neteeza®, VSAM (ESDS, KSDS, RRDS, and LDS), PDS(/E), and sequential targets are supported.

Explore the PK Protect Suite

Data discovery and protection solutions that locate and secure sensitive data
Find data wherever it lives in the enterprise
Learn More
Categorize data for tagging and reporting
Learn More
Irreversible yet auditable protection
Learn More
File encryption for both protection and analytics
Learn More
Manage retention policies and fulfill DSAR
Learn More
Frequently Asked Questions
Yes. Standard and Enterprise editions are available for PK Protect.
PK Protect supports AES128, AES192, AES256, DES, 3DES, RC4, and Suite B.
PK Protect is always available under the latest release of z/OS; PKWARE wants to ensure that we take advantage of the latest OS enhancements and features and pass those onto our customers
From a hardware perspective, PK Protect supports HSM. For software, we support KeyStore, ICSF-CKDS, PKDS, Security Server, RACF, ACF2, Top Secret, and PK Protect Enterprise Manager.
Yes, files that have been processed by PK Protect for use with z/OS can be shared with other PK Protect agents on any platform. PK Protect for use with IBM z/OS, IBM i, USS, IFS, Linux, AIX, Windows, Mac, and mobile are all compatible with one another and will properly address file formatting and translation of data as necessary.