Abstract: A method and associated computing system. A first computing environment receives data that includes first sensitive data. The first computing environment includes a hypervisor, a virtual machine running on the hypervisor, and a compliance gateway coupled to the virtual machine and the hypervisor. The compliance gateway intercepts the request. The compliance gateway inspects the intercepted request, does not find sensitive data in the request from inspecting the intercepted request, and forwards the request directly to the virtual machine in response to not finding sensitive data in the request. The virtual machine receives the request from the compliance gateway and in response. The virtual machine initiates performance of an operation indicated in the request. The hypervisor determines that the performance of the request requires the first sensitive data that is sensitive, and in response the hypervisor prevents the virtual machine from completing performance of the operation, by intercepting the operation.

Abstract: A method and associated computing system. A first computing environment receives data that includes first sensitive data. The first computing environment includes a hypervisor, a virtual machine running on the hypervisor, and a compliance gateway coupled to the virtual machine and the hypervisor. The compliance gateway intercepts the request. The compliance gateway inspects the intercepted request, does not find sensitive data in the request from inspecting the intercepted request, and forwards the request directly to the virtual machine in response to not finding sensitive data in the request. The virtual machine receives the request from the compliance gateway and in response. The virtual machine initiates performance of an operation indicated in the request. The hypervisor determines that the performance of the request requires the first sensitive data that is sensitive, and in response the hypervisor prevents the virtual machine from completing performance of the operation, by intercepting the operation.

Abstract: A method and associated computing system. Data received by a computing environment includes a mixture of non-sensitive data and sensitive data along with related metadata indicative of a sensitivity of the sensitive data. The computing system includes the computing environment. An operation is performed on the sensitive data in the computing environment by: (a) determining that the data used for the operation are sensitive data, (b) intercepting the operation on the sensitive data, and (c) registering newly created sensitive data, as a result of the operation, with metadata indicating one or more addresses of the sensitive data. An external access to the sensitive data in the computing environment is intercepted. A compliance firewall rule is applied to the sensitive data intended to leave the computing environment. The compliance firewall rule defines an action to be applied to the sensitive data such that the sensitive data are protected against unauthorized access.