AES256 cardholder field encryption Optional #
Keep stored card numbers unreadable
All sensitive cardholder fields held in the database are encrypted with AES256 using data encryption keys generated automatically as required.
Data Encryption is part of Security & Control in Windward System Five. System Five includes 6 documented capabilities here — all 6 in the standard set.
These 6 capabilities sit within System Five's 1287-capability documented set — a selection, not a ceiling.
Keep stored card numbers unreadable
All sensitive cardholder fields held in the database are encrypted with AES256 using data encryption keys generated automatically as required.
Lock down the database files themselves
A one-click option sets a 24-byte database-level encryption key on every file that could hold cardholder information, layered on top of the application's own AES256 encryption. Keys and files can also be regenerated and re-encrypted from the File Check utility.
Keep a safe copy of the keys
Supervisors can export the key encrypting keys to a Windward Key File for safe off-site backup, and import them to another station, with a live view of which keys are present or missing and which licensed terminals are logged in.
Re-key everything after a scare
A single option regenerates the whole key set and re-encrypts every field that could contain cardholder data, then deletes the old keys, for use after a suspected breach.
Limit what one stolen key exposes
New keys are generated on the normal compliance cycle and new data is stored under the newest key, so no single key protects the entire history of stored card data.
Rotate encryption keys on schedule
Randomly generated data encryption keys are themselves encrypted by key encrypting keys held in the registry of each machine; a Rotate Keys function deletes the existing set, generates six new keys, distributes them to logged-in stations and re-encrypts every data key.
Yes. All sensitive cardholder fields held in the database are encrypted with AES256 using data encryption keys generated automatically as required. This is optional in System Five.
Yes. A single option regenerates the whole key set and re-encrypts every field that could contain cardholder data, then deletes the old keys, for use after a suspected breach. This is optional in System Five.
Every capability on this page is documented in the System Five capability index. Last updated 2026-11-05.