<img src="https://ad.doubleclick.net/ddm/activity/src=11631230;type=pagevw0;cat=pw_allpg;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=${GDPR};gdpr_consent=${GDPR_CONSENT_755};ord=1;num=1?" width="1" height="1" alt="">

Virtru Developer Experience

Virtru Data Harbor Platform SDKs and APIs

Build Access Control Into The Data - Wrap data in the Trusted Data Format (TDF) and enforce attribute-based access control (ABAC) on every request, under your policy. Read the docs, run the quickstart, and build a prototype without talking to anyone.

Read the docs

 

software-engineer-client-side-encryption

Start Building Today

https://1769758.fs1.hubspotusercontent-na1.net/hubfs/1769758/assets/images/icons/utility%20icons/tools-icon.svg

Data Harbor Platform SDKs

SDKs for Go, JavaScript/TypeScript, and Java, plus gRPC and a CLI. The APIs we publish are the APIs we build with.

Learn More
https://1769758.fs1.hubspotusercontent-na1.net/hubfs/1769758/Virtu_2022/TDF/End-to-End-Encryption.svg

Your First TDF in About 10 Minutes

Run the OpenTDF quickstart for basic encrypt and decrypt. The full ABAC scenario takes about 30 minutes, with no account needed.

Learn More
https://1769758.fs1.hubspotusercontent-na1.net/hubfs/1769758/AI-icon.png

AI Agents

Give each agent its own identity and entitlements. Every request it makes is checked against your policy, just like a person's.

Learn More
https://1769758.fs1.hubspotusercontent-na1.net/hubfs/1769758/Virtu_2022/site-pages/OpenTDF-Logo.png

TDF, an Open Standard

TDF originated at the NSA and is open on GitHub. Read the spec, and verify exactly how it works.

Learn More

Govern The Data Your AI agents Reach

AI agents are the fastest-growing class of data recipients. On the Virtru Data Harbor Platform, each agent gets its own identity and entitlements, not a shared service account or a borrowed login. Every request an agent makes is checked against your policy, just like a person's.

Revoke an agent's entitlements and its next request is refused. If one agent hands an object to another, the object stays protected until the second agent has entitlements of its own. Every agent, every request, your rules.

Agents reach protected data through their own entitlements, like any other identity. MCP is for administrators working through an AI assistant.

Authenticate an Application or Agent

 

How It Works: Wrap, Request, Enforce, Prove

Data has to move. The job is to make sure governance travels with it. Perimeter controls protect places, and once data leaves them, the policy stays behind. TDF cryptographically binds your access policy to the data instead, so the policy goes wherever the data goes. The data is protected because of what it is, not where it lives.

Wrap

Encrypt data as a TDF object, with its attributes bound to it. Tamper with them, and the object opens for no one.

Request Access

Every access attempt is a request. The platform compares the requester's entitlements, from your identity provider, with the data's attributes.

Enforce at the Key

You write the rules; the Data Harbor Platform makes the call and enforces it at the key: no yes, no key, no data

Prove Every Decision

Every key release and every refusal is recorded in a cryptographically verifiable audit trail: who or what asked, and the answer.

The Data Harbor Platform

Screenshot 2026-11-13 at 3.03.16 PM

Requests come from people, partner systems, and AI agents. You write the rules; the platform makes the call and enforces it. Its control plane holds policy, attributes, entitlements, key access, and audit, and connects to the identity providers, tagging tools, and policy systems you already run.

The platform is pre-wired to the systems on which your Attribute-Based Access Control (ABAC) decisions depend. DSPM, DLP, and classification platforms feed data attributes into the Tagging Service. IdPs and ICAM systems supply subject entitlements for both human and AI identities. HSMs, cloud KMS, and S3-compatible storage plug in at the infrastructure layer.

Your posture management, DLP, and classification tools feed data attributes in through the Tagging Service. Your identity providers supply entitlements for people and AI agents. Hardware security modules and cloud key management plug in underneath.

Compare the Data Harbor Platform and OpenTDF

Start Free. Scale Up.

Build for production on the Virtru Data Harbor Platform, and prototype for free on the open-source OpenTDF SDKs.

Build for Scale on the Data Harbor Platform.

Built for production, with enterprise extensions on top of everything in OpenTDF. Deploy it self-managed, in your cloud, on-premises, or fully air-gapped.

  • Platform SDKs or Go, JavaScript/TypeScript, and Java, plus a CLI, and MCP for AI-assisted administration
  • Data tagging, and ZTDF (ACP-240) and IC-TDF formats
  • Policy import and export, and certificate management · Encrypted search, plus storage, SQL, and vector connectors

go-blue

Read the SDK Docs

View the Developer Documentation

To try the Data Harbor Platform, request evaluation access, and we'll set you up with the SDKs, training, and an environment to build in.

 

Feature Comparison for OpenTDF and Virtru Solutions

The chart below compares OpenTDF and the Virtru Data Security Platform, highlighting key differences in scope, capabilities, and use cases.

Feature Category OpenTDF Virtru
Administration & Management
System ConfigurationHeadless / Config-as-Code
Configuration requires editing YAML/JSON files, Helm charts, or making direct API calls. No visual interface.		Unified Web Console
Comprehensive graphical interface for managing system settings, platform configurations, and service integrations.
Policy ManagementCLI / API onlyVisual Policy Builder
No-code, drag-and-drop web UI for defining attributes, creating rules, and managing access logic.

Import / Export Policy
Support for import and export of atomic policy bundles with the ability to run the platform backed by a read-only policy backbone.
Standards & Interoperability
TDF Formats SupportedBase TDF Only
Reference implementation of the standard JSON-based Trusted Data Format.		Multi-Format Support
Support for Base TDF, IC-TDF (US Intelligence Community), ACP 240 ZTDF, and proprietary Binary TDF for high-volume data streaming and IoT applications.
Data Tag Extraction and Processing None
No native tagging service; developers must build their own solution to extract attributes from raw data and normalize across multiple data tagging regimes.		Extensible Tagging Service
Fully supported Tagging Service with out-of-the-box support for CCEB STANAGs, US Intelligence Community Handling Metadata , and Fortra tags. Extensible via API.
Data IntegrityHooks Only
API stubs for assertions, but no direct support for Organizational PKI. Default implementation requires data entitlement to verify metadata signatures.		Signed Assertions
Native integration with Organizational PKI to cryptographically sign metadata for non-repudiation and provenance.
Integrations & Ecosystem
Policy Enforcement Points (PEPs)Build Your Own
SDKs provided; you must write the code to integrate policy enforcement into applications.		Full Collaboration and Data Analytics Suites
Ready-to-deploy PEPs for Microsoft Outlook, Exchange, SharePoint, SMTP Gateway, Windows Desktops, Secure Share Enclave; S3 Object Storage, Apache Trino, and Apache NiFi. Proprietary SDKs for advanced features like data tagging.
Centralized Configuration Service N/AConsolidated Service Management
Allowing for streamlined administration of deployed PEP solutions
Search CapabilitiesN/AEncrypted Search
Proprietary technology enabling search over encrypted data without decrypting the payload.
Authorization ExtensibilityN/AIntegration With Authorization Systems
Allows extension of the base authorization system
Identity Provider SupportLimited
Reference implementation tightly coupled with Keycloak.		Universal Identity Support
Agnostic integration with any OIDC/OAuth2 provider, including Ping Federate, Okta, Azure AD, and Keycloak.
Key Management
HSM SupportSoftware Only
Basic Key Access Service (KAS) implementation without hardware bindings.		Enterprise HSM & Cloud KMS
Native support for Thales Luna, Entrust nShield, AWS KMS, and Google Cloud KMS.
CryptographyStandard
Base AES encryption for data Encryption with support for RSA or ECC-based key encryption .		Advanced & Future-Proof
FIPS-validated options and support for FIPS-203/204 Post-Quantum Cryptography.
Enterprise Security
Audit LogsNoYes
SSO with SAML 2.0 supportNoYes
Compliance (HIPAA, SOC-2 Type 2, FedRAMP Moderate, PCI-DSS)NoYes
Deployment
Self-Hosted / DIY
You define the architecture, scaling, and reliability engineering.		SaaS / Hybrid / Private
Managed SaaS or customer-hosted private cloud options with SLA guarantees.
Support
Open source community-based support (no SLA)Help and support from the creators and maintainers of OpenTDF.

Connect Your Data Stores

Connectors sit between your applications and your data, so policy applies from the moment data is stored or queried, with little or no change to your application code.

Files-sharing11

Storage Connector

Protect objects in any S3-compatible store, including AWS, Google Cloud Storage, MinIO, and Cloudflare. Every read is checked against your policy.

  • Works with S3-compatible stores
  • Objects stay protected
  • Every read is checked

server-icon

SQL Connector

Query protected SQL tables through a Trino-compatible connector. Rows and columns are released only to the entitled people or agents .

  • Row and column control
  • Standard SQL queries
  • Every query is recorded

complex-highways

Vector Connector

Govern the vector stores behind your AI. Retrieval over TDF-protected chunks in pgvector returns only what the person or agent is entitled to see.

  • Policy-aware retrieval
  • Built for AI agents
  • Works with LangChain

How Others Are Building

See how others, from gateway developers to messaging and identity providers, have built on the Data Harbor Platform. Choose one to see how it plugs in.

Build an Integration

The Data Harbor Platform is fully extensible. Build an enforcement point into your product: it asks the platform for a decision, and your product carries it out.

Build for government, defense, and enterprise customers. Whether you're a systems integrator on one customer's program or an ISV shipping TDF protection in your product, you build the enforcement point. The platform makes the call and handles the cryptography.

circles-icon2

Integration Points

  • SDKs: Go, Java, and JavaScript libraries for creating and reading TDF objects
  • Policy Service API: Programmatic access to attribute definitions and policy decisions
  • Key Access Service: OIDC-authenticated key release tied to ABAC entitlements

Lightbulb Icon-png

Developer Resources

  • Developer Docs: getting-started guides, API reference, and integration patterns. Free.

  • Architecture Overview: Platform components, data flows, and deployment models

  • API Reference: gRPC and HTTP APIs for policy, attributes, key access, and tagging

Government Developer Employee

Ready to Build on the Data Harbor Platform?

Tell us what you plan to build, and we'll equip you with the SDKs, training, and support to make it a reality.

Request Evaluation Access

6,100 CUSTOMERS TRUST VIRTRU FOR DATA SECURITY AND PRIVACY PROTECTION.