Find what’s sensitive in your mainframe files. Then encrypt it, mask it, or both.

Mainframe data encryption protects data on and leaving IBM Z by encrypting the data itself rather than the channel it moves through. The protection stays attached to the file after it reaches a distributed server, a partner system, or cloud storage, and anyone holding the key can recover the original values. It’s the right choice when the data has to stay exact for whoever receives it.

Mainframe data masking replaces sensitive values inside z/OS data sets with realistic substitutes, so the data keeps its structure and stops carrying risk. A masked card number is still sixteen digits and still passes the checks your applications run, but it isn’t anyone’s actual card number. There’s no key, because there’s nothing to recover.

Encrypt when the recipient needs the real values back, and mask when they don’t. Partner feeds, archives, and downstream systems that process live transactions need encryption, because the data has to stay exact. Development, test, analytics, AI training sets, and most screens need masking, because those users need data that behaves correctly and never needed the real numbers. Most organizations do both, from the same discovery run, choosing per data set rather than per product.

You prove it with an inventory and a record of what was done to it. An auditor asking about PCI DSS 4.0 or a privacy regulation wants to know which data sets hold sensitive values, what protection was applied to each one, and when. PK Protect produces the inventory through discovery and the evidence through the protection it applies, so the answer is a report rather than an explanation from the person who has been there longest.

Yes. They serve different copies of the same data, not competing approaches to one copy. A common pattern is encrypting the production file that leaves the platform on a nightly job while masking the copy that populates the test region, both driven by one discovery scan and one policy.

Yes. PK Protect discovers, encrypts, and masks sensitive data in VSAM data sets, along with sequential data sets, partitioned data sets (PDS), and generation data groups (GDG). VSAM is the one people ask about because it holds the transactional records, but the coverage isn’t limited to it.

Yes. PK Protect uses deterministic masking, meaning the same input always produces the same output. A customer masked on z/OS and masked again in Oracle, Snowflake, or a file share comes out identical in each one, so the records still join and your reporting still works.

Yes, and that’s the mechanism rather than a limitation. SchemaLink generates the schema from the source your programs are actually compiled against, which is what makes the results exact instead of probabilistic. A definition that no longer matches what a program writes shows up as non-conforming data instead of passing silently. Data sets with no available definition are still inventoried, and reported as unresolved rather than guessed at.

Those tools read the record byte by byte and flag anything that matches a pattern. The claim is accurate and it’s also the point: without your definitions, nothing can tell the scanner that the nine digits sitting at byte 51 are a Social Security number rather than a policy number that happens to be nine digits long. You get a number you can’t act on and a false-positive count that scales with the size of your data.

Pervasive Encryption protects data while it’s on the platform, and it does that well. It stops at the edge. When a batch job writes a file and something moves it, the file lands readable on the other side, then gets copied into test environments, vendor systems, and cloud storage by people who weren’t in the original design review. PK Protect finds what’s sensitive first, then protects the data itself so it stays protected everywhere it goes next.

No. Masked values keep the original format, length, and data type, so an application reading a masked record can’t tell the difference. A sixteen-digit card number stays sixteen digits and a date stays a valid date. Encrypted files are protected at the file level and decrypt on the other side with the key, so the receiving application reads what it always read.

DB2 is covered by PK Protect Data Store Manager, which handles structured sources across databases, data lakes, cloud repositories, and packaged applications. Most mainframe organizations run both alongside each other, under one policy.

Discovery produces findings on the first scan. What takes time is deciding what to do with them, since that’s a conversation between security, compliance, and the application teams who own the data sets. The technical work is rarely the long pole.