eperi Encryption Gateway

Short Summary

eperi GmbH is a privately held security software vendor headquartered in Darmstadt, Germany, founded in 2003, with extensive experience in encryption, key management, and enterprise security projects across Germany and Europe. The company’s core offering is a universal, transparent encryption gateway that enables end-to-end (“Zero Knowledge”) encryption and tokenization for cloud services, SaaS applications, web applications, databases, file stores, and other protocols—while keeping encryption and key management under the data owner’s control, ideally on-premises. This approach addresses a central cloud risk: while many SaaS providers offer encryption, customers as data controllers remain responsible for preventing unauthorized access, and only encryption models where providers never see plaintext or keys can reliably mitigate breaches and malicious insiders while shrinking GDPR compliance scope and preserving data sovereignty.

Conventional end-to-end encryption often degrades application functionality because SaaS services cannot search, sort, filter, or analyze encrypted data. eperi mitigates this by maintaining an on-premises index of encrypted structured and unstructured data, allowing the gateway to perform searching and sorting locally and relay adapted queries to the SaaS service without resorting to weakened encryption methods. The technology relies on an extensible, XML-based template system defining what to encrypt and how, optionally incorporating BPEL workflows or Java extensions. Implemented as a transparent multiprotocol proxy, it requires no changes to applications or network infrastructure and remains invisible to authorized users.

eperi provides out-of-the-box support for 30+ SaaS applications, including Office 365 and Salesforce, with deployments typically completed in hours. The product supports standard cryptography (AES-256/RSA-2048), HSM integration, and even customer-defined algorithms. Core technology was developed with the German Federal Office for Information Security (BSI), released under LGPL, and approved for German government use—yet the company has historically struggled with market visibility, prompting a 2016 shift toward product-focused global expansion and tighter integration with CASB ecosystems.

Interesting Facts

• eperi GmbH is headquartered in Darmstadt, Germany and was founded in 2003.
• The company serves over 100 enterprise customers and government agencies.
• Collaboration with the German Federal Office for Information Security (BSI) contributed to the gateway’s core technology.
• The gateway uses configurable templates to provide transparent encryption for databases, file stores, web applications, and cloud services.
• The product is implemented as a transparent network proxy that can intercept and selectively encrypt multiple network protocols.
• Templates are XML-based and can include BPEL workflow definitions or be extended with executable Java code.
• The gateway can be deployed on an application server, in a virtual machine, or as an appliance, on-premises or in cloud infrastructure.
• Default cryptography includes AES-256 and RSA-2048, with support for HSM-based encryption and key management.
• The gateway maintains an on-premises index of encrypted data to enable searching and sorting without weakening encryption.
• The gateway provides out-of-the-box support for applications such as Office 365 and Salesforce, with typical rollout taking several hours.

Notable Quotes

• “Only end-to-end encryption or tokenization where sensitive data never even leaves the premises without pseudonymization can guarantee that it won’t be compromised even in the case of a data breach or as a result of malicious insider activities.”
• “This approach also greatly reduces the GDPR compliance scope and guarantees that full sovereignty control of the sensitive data remains in the hands of the data controller.”
• “The only approach towards encrypting data stored in the cloud, which guarantees that the data confidentiality cannot be compromised by a malicious third party … is the so called ‘Zero Knowledge’ end-to-end encryption.”
• “Since the solution itself is implemented as a transparent network proxy, it can intercept and selectively encrypt a wide range of network protocols, while remaining completely invisible to existing systems.”
• “Unauthorized users will only see unreadable encrypted data.”
• “A major flaw of any true end-to-end encryption solution is that it introduces inevitable limitations in the functionality of host applications.”
• “To address this, eperi Gateway maintains an on-premises index of all the data it encrypts, both structured and unstructured.”
• “Thus, searching and sorting works completely transparently for users without the need to rely on such workarounds like weaker deterministic encryption methods.”
• “Whereas CASBs are primarily focusing on solving the ‘shadow IT’ problem … eperi Gateways address the security and privacy issues of the ‘sanctioned cloud’…”
• “Typically, a rollout of the complete solution only takes several hours and does not require any changes in existing business processes.”