Platform

Collect. Tokenize. Govern.

cloakit sits between your systems and your sensitive data. Raw values enter the vault once; everything downstream runs on tokens under policy.

Operating model

Live in hours, compliant in weeks.

Collect to the vault

SDKs and Elements post sensitive fields straight to cloakit — they never touch your servers, logs, or error trackers.

Store tokens only

Your databases and warehouses hold opaque references. Joins and queries keep working on stable token IDs.

Govern every use

Detokenize, share, or analyze strictly under policy — per role, purpose, and region, fully audited.

Enforcement points

One boundary, eight controls.

Mirrors the reference deployment: a runtime data plane, a separate control plane, and keys held outside the database. Fail-closed by topology, not just by code.

Gateway

OpenResty/sidecar proxy applying JSON-path rules at the edge; admin endpoints blocked there by design.

Runtime API

POST /v1/tokens · :detokenize · :search plus mask, protect, delete, and job polling — every call authenticated and idempotent.

Vault

Postgres-backed encrypted values and token mappings with a blind index for approved exact-match search. No plaintext PII indexes.

Policy engine

Versioned policies: claim-to-scope identity, purpose checks, denylist, kill switch, and revocation epochs. Default is deny.

Crypto adapter

Envelope encryption with DEK caching. Ciphertext and wrapped keys never leave to ordinary clients.

Key providers

Bring your own KMS: AWS, GCP, Azure, OpenBao, or localdev. Separate key policies for audit, vault, and config.

Control plane

Tenants, schemas, policies, IdPs, and providers managed via a separate API; the console talks only to it — never to the vault.

Audit pipeline

Async, append-only events with actor, app, policy version, and correlation IDs — exportable to your SIEM.

Architecture

The request path, visualized.

Every sensitive operation travels the same governed path: sources enter through the gateway, policy decides, the vault stores, and consumers receive tokens — with each step audited.

%%{init: {'flowchart': {'curve': 'linear'}, 'theme': 'base', 'themeVariables': {'primaryColor': '#ffffff', 'primaryBorderColor': '#2457C5', 'primaryTextColor': '#101828', 'lineColor': '#2457C5', 'fontFamily': 'IBM Plex Sans, sans-serif', 'fontSize': '14px'}}}%% flowchart TB subgraph CL["Application + integration layer"] WEB["Browser / React SDK
hosted capture"] BE["Backend SDKs
Python · plain REST"] GW["cloakit Gateway
OpenResty / sidecar · JSON-path rules"] end subgraph DP["cloakit Data Plane · runtime"] API["Runtime API
/v1/tokens · :detokenize · :search"] ID["Identity + credential validation
OIDC · claim to scope"] POL["Policy decision engine
versioned · deny by default"] TR["Transform
tokenize · mask · redact · protect"] TOK["Token engine
opaque random · cl_tkn_v1_…"] VAULT[("Vault · Postgres
encrypted values + mappings
blind index")] CRYPTO["Crypto adapter
envelope encryption"] KMS[("KMS / HSM
AWS · GCP · Azure · OpenBao")] AUD["Audit pipeline
async · SIEM export"] end subgraph CP["cloakit Control Plane"] CON["Admin console
Next.js · control API only"] CTRL["Control API
tenants · schemas · policies"] CAT["Schema registry
166-element catalog"] PUB["Policy publisher
validate · publish · rollback"] end WEB --> API BE --> API GW --> API API --> ID --> POL --> TR --> TOK --> VAULT TOK -.-> AUD POL -.-> AUD VAULT --> CRYPTO --> KMS CON --> CTRL --> CAT CTRL --> PUB PUB -.-> POL PUB -.-> TR style GW fill:#2457C5,stroke:#172B4D,color:#fff style VAULT fill:#172B4D,stroke:#172B4D,color:#fff style POL fill:#B7E445,stroke:#172B4D,color:#101828

Originals never leave the vault boundary. Tokens carry the shape; policy carries the authority.

Request lifecycle

The tokenize call, over time.

A single tokenize request through the data plane — and what happens when policy says no.

%%{init: {'sequence': {'mirrorActors': false}, 'theme': 'base', 'themeVariables': {'primaryColor': '#ffffff', 'primaryBorderColor': '#2457C5', 'primaryTextColor': '#101828', 'lineColor': '#2457C5', 'fontFamily': 'IBM Plex Sans, sans-serif', 'fontSize': '14px'}}}%% sequenceDiagram autonumber participant App as Your app / SDK participant GW as cloakit Gateway participant API as Runtime API participant ID as Identity
claim to scope participant POL as Policy engine participant TOK as Token engine participant V as Vault (Postgres) participant AUD as Audit pipeline App->>GW: POST /v1/tokens
{schema, field, value} GW->>API: forward + Idempotency-Key API->>ID: validate bearer token ID->>POL: scopes + context POL->>POL: evaluate rules
deny by default alt allow POL->>TOK: issue token TOK->>V: store encrypted value V-->>TOK: record_id TOK-->>App: cl_tkn_v1_… + policyVersion TOK-.->AUD: tokenize event else deny POL-->>App: 403 + audit event end

Every arrow is authenticated; every branch is logged with actor, purpose, and correlation ID.

Ecosystem