Skip to main content

Custom and Client-Side Encryption

Guidewire enforces a secure, reliable, and compliant encryption posture across the Guidewire Cloud Platform (GWCP). This includes a strict prohibition on custom and client-side encryption mechanisms. Customers must use only vetted, platform-approved encryption libraries and protocols to ensure interoperability, maintainability, and protection against evolving threats.

Why Custom Encryption Is Prohibited​

Custom encryption solutions pose significant risks:

  • Lack of Cryptanalysis – Custom algorithms lack the rigorous peer review and testing applied to industry standards like AES and RSA.
  • Poor Key Management – Non-standard implementations often mishandle key generation, storage, and rotation.
  • Implementation Errors – Even standard algorithms can be implemented incorrectly, leading to weak protection.
  • Reduced Interoperability – Custom solutions may be incompatible with compliance frameworks, APIs, or third-party systems.
  • Maintenance Challenges – Keeping up with emerging threats is difficult without centralized, vetted libraries.

Custom encryption introduces avoidable risk. GWCP ensures platform-wide consistency and security by disallowing such implementations.

What About Using Standard Algorithms in Custom Code?​

RiskDescription
No Peer ReviewImplementation may include hidden flaws undetectable without expert analysis.
Weak Key HandlingWithout centralized key management, keys can be leaked, reused, or improperly stored.
Vulnerability to Known AttacksBrute force, padding, and side-channel attacks often exploit poor implementations.
IncompatibilityCustom schemes break integrations and complicate upgrades or audits.
False ConfidenceDevelopers may assume security based on algorithm choice alone, not implementation quality.

Integration Guidance: Approved Alternatives​

For secure data exchange between systems, use:

  • TLS 1.2+ with Mutual TLS (mTLS) – Ensures end-to-end encryption with strong identity verification.

  • API Gateways – Leverage Guidewire or enterprise-managed API gateways to enforce encryption, authentication, and access policies uniformly.

  • Centralized Integration Platforms – Use platforms that offer standardized security management and compliance enforcement across services.

  • These approaches reduce the risk of misconfiguration and ensure long-term maintainability.

Additional Resources​

To further strengthen your understanding and implementation, these resources provide additional guidance on secure coding practices.

Guidewire:

Additional:

Legal and Support Information
Copyright © 2001-2025 Guidewire Software, Inc.