Very Good Securityvs
HashiCorp Vault
HashiCorp Vault: If you want to run secrets and encryption infrastructure yourself rather than route production traffic through a vendor
Very Good Security
Tokenisation proxy that keeps card and personal data out of your own systems and out of PCI scope
As of 31 August 2026, Very Good Security starts at $1000/month. VGS intercepts sensitive data before it reaches your servers, replaces it with aliases, and holds the originals in its own vault. Softwr lists it under Cybersecurity. Very Good Security is available on Web, API.
Overview
What Very Good Security does
Very Good Security operates a reverse and forward proxy in front of your application. Card numbers, bank details and other sensitive fields are captured at the edge, swapped for format-preserving aliases, and stored in VGS vaults. Your application, database, logs and analytics only ever see aliases. When you need to send real values onward, to a payment processor, a card network or a partner, VGS reveals them on the outbound leg. The company calls this the Zero Data approach and it now positions itself primarily around payment tokenisation, network tokens, processor optionality and card issuing data. The commercial argument is compliance scope rather than encryption. Because plaintext cardholder data never lands on your systems, a merchant or fintech can attest against a far narrower PCI DSS boundary, often the difference between a full Level 1 Report on Compliance across a sprawling estate and a much smaller assessment. The second argument is processor independence: because the card numbers sit in a vault you control access to rather than inside one acquirer, you can route to a second processor or renegotiate without a card data migration, which is normally the thing that locks a merchant to an acquirer for years. The buyer is typically a fintech, marketplace or high-volume merchant with either a compliance deadline or a processor negotiation coming. The trade-off is that you have inserted a third party into the critical path of every payment request. Latency, uptime and the vendor's own continuity become your problem, and extracting yourself later means a token migration that the vendor has no commercial reason to make easy. Published pricing starts around one thousand US dollars per month for the entry package with everything above that quoted.
What people use it for
- A marketplace facing its first PCI DSS Level 1 assessment that wants to keep card data off its own estate rather than harden a dozen services
- A merchant negotiating with a second acquirer that needs card credentials portable so the negotiation is real rather than theoretical
- A fintech collecting bank account and identity documents that wants sensitive fields absent from logs, backups and analytics warehouses by construction
- A card issuer that must display a full PAN in its own mobile app without the app or its backend touching cardholder data
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Very Good Security.
- VGS sits in the live path of every request carrying sensitive data, so its latency and availability become yours, and an outage in the proxy is a payment outage no matter how healthy your own systems are.
- Token portability is the whole selling point yet leaving VGS means migrating tokens back out, a project the vendor has no incentive to streamline, so the lock-in you removed from your acquirer partly moves to VGS.
- Entry pricing at around one thousand US dollars a month is real money for a pre-revenue fintech, and it buys volume-limited throughput, so cost scales with exactly the growth that made you buy it.
- Scope reduction is not scope elimination: your QSA still assesses how you integrate, and teams regularly discover that a support tool or an internal admin screen pulled plaintext back in and dragged systems into scope again.
- Proxy-based interception constrains how you design request flows, and non-standard payloads, streaming uploads or binary formats often need custom routing rules that make debugging production issues noticeably harder.
Cross-shopped
What people choose instead of Very Good Security
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
- Very Good SecurityvsStripe
Stripe: If a single processor is acceptable and you would rather use its vault and never handle card data at all
- Very Good SecurityvsAdyen
Adyen: If you want the acquirer to hold tokens and you are not planning multi-processor routing
Pricing
What Very Good Security costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Starter
$1,000 /mo
- Aliasing proxy
- Vault storage
- PCI scope reduction
- Standard support
- Volume limits apply
Growth
On request
- Network tokenisation
- Multiple processors
- Data residency options
- Higher throughput commitments
- Quoted pricing
Enterprise
On request
- Custom vault architecture
- Dedicated support and SLA
- Contractual compliance coverage
- Annual commitment
Capabilities
Features
Aliasing proxy
Inbound and outbound proxies substitute sensitive values for format-preserving aliases
PCI scope reduction
Cardholder data never touches customer infrastructure, narrowing the assessment boundary
Network tokenisation
Issues and manages card network tokens for higher authorisation rates and updated credentials
Processor optionality
Reveal the same stored card to more than one acquirer without a data migration
Card issuing data
Secure display and capture of PAN and PIN for issued cards
Vault and access controls
Role-based rules governing which systems may reveal which fields
Data residency options
Vaults in selected regions for jurisdictional requirements
Compliance artefacts
PCI DSS, SOC 2 and HIPAA aligned attestations covering the vaulted environment
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Does VGS make me PCI compliant?
No. It removes cardholder data from your systems so your assessment covers a far smaller boundary, but you still complete an assessment and your integration is part of it.
Can I move to another processor without re-collecting cards?
Yes, that is a core reason people buy it. The vault reveals stored credentials to whichever processor you route to.
What does it cost?
Published entry pricing is about one thousand US dollars per month; growth and enterprise tiers are quoted.
Is it only for card data?
No. The proxy handles any sensitive field, including bank details, national identifiers and documents, though payments is where the product is now focused.
Keep looking
Where to go from Very Good Security
- Very Good Security alternativesEvery product people weigh against it
- Very Good Security pricingPlans, floors and what the tiers exclude
- Very Good Security badgesWhich rules it meets, and the figure behind each
- All Cybersecurity softwareThe full category
- Best Cybersecurity softwareThe shortlist, and how it was cut
Best Cybersecurity software for
Compare Very Good Security with
- Baffle
- HashiCorp Vault
- Feedzai
- Securiti
- Featurespace ARIC Risk Hub
- Varonis Data Security Platform
- LastPass
- DataGrail
- 1Password
- Transcend
- Doppler
- Tuta
- Delinea
- Envysion
- Frontegg
- HashiCorp Boundary
- Feedzai
- Doppler
Other Cybersecurity software
Transparent proxy that encrypts, tokenises and masks database fields without application code changes
Pricing on request13 researched notesReal-time transaction fraud and financial crime detection for banks and payment processors
Pricing on request10 researched notesData and AI security posture management with privacy operations on a single data catalogue
Pricing on request13 researched notesAdaptive behavioural analytics for payment fraud and financial crime
Pricing on request10 researched notesData security platform that maps effective permissions, content classification and access activity across file shares, Microsoft 365 and SaaS.
From $100/yr14 researched notesPrivacy platform that finds shadow data systems and automates data subject requests across them
Pricing on request12 researched notesPrivacy request automation, consent and AI governance across internal systems
Pricing on request12 researched notesPrivileged access management from the merged Thycotic and Centrify
Pricing on request11 researched notesManaged video for restaurants and convenience stores that pairs camera footage with point of sale transaction data
Pricing on request12 researched notesCustomer identity and access management platform for SaaS applications
Free plan9 researched notesIdentity-aware session broker for infrastructure access without distributing credentials
Open source12 researched notesReal-time transaction fraud and financial crime detection for banks and payment processors
Pricing on request10 researched notes
Softwr does not host reviews and shows no star rating for Very Good Security, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Very Good Security
Very Good Security alternatives
What people switch to, and what they give up
Very Good Security pricing
Every tier, and where the cost actually lands
Compare Very Good Security
Put it head to head with anything we hold
Very Good Security badge
Its rating, and an embed for your own site
Best Cybersecurity software alternatives
Large Chinese video platform that US federal buyers and federal contractors cannot lawfully use
quote
Managed video loss prevention with human auditors for restaurants, convenience stores and retail
quote
Workforce and customer authentication from a certificate authority
Per user per month
Privileged access management, endpoint privilege management and secure remote access
quote
Cloud video surveillance billed per camera per month, where retention length drives the bill more than anything else
Per camera per month
AI video search that runs on cameras you already own, starting near five dollars per camera per month
Per camera per month
Phishing-resistant passwordless authentication with device trust enforced at every login
quote