Tokens that keep their shape, lose their risk.
Tokenization swaps sensitive values for opaque references with no mathematical path back. cloakit goes further: per-column token maps that preserve format and joins.
Same shape. Zero sensitivity.
Illustrative sample values.
Schema-based tokenization
Each field tokenizes under its own map, context, and method menu — card numbers, emails, and IDs each protected per the field's own policy, never intermixed across types.
| Input field | Protected value |
|---|---|
| card.pan | cl_tkn_v1_… |
| user.email | cl_tkn_v1_… |
| user.id | tok_01J… |
Real shapes: opaque values with tok_… IDs. Prefixes are operational only — never reversible.
Random by default. Deterministic only on purpose.
Tokens are opaque and unpredictable, carry tenant, vault, field, and purpose context, and are treated as sensitive identifiers in their own right — linkable, never plaintext.
Opaque random tokens
Default issuance is random cl_tkn_v1_… values. Deterministic tokens need a documented use case, separate key and context, and tenant opt-in.
Revocation, not regret
Token statuses, revocation epochs, a denylist, and a kill switch end usability without re-encrypting datasets.
Searchable, safely
Approved exact-match search runs over a blind index — unapproved fields return 403, never data. No plaintext PII indexes, ever.
166-element catalog
72 core + 93 India + 1 US data elements ship with method menus — tokenize_opaque, mask (keep_suffix, redact_all), or allow — plus per-field invalid handling and log redaction.
Why a vault, not just math.
Vaultless tokenization derives tokens cryptographically — fast, but coarse. A vault adds the controls regulated teams actually get audited on.
Per-field policies
Different token maps, formats, and access rules per column — not one shared scheme.
Revocation
Kill a token's usability without re-encrypting datasets or rotating derived keys everywhere.
Residency
Pin originals to regions; tokens travel, vaults stay home. Math alone can't do geography.
Auditability
Every detokenization is an event with actor, purpose, and region — not an invisible derivation.
Revocation, not regret.
Tokens move through explicit states. Revocation epochs, the denylist, and the kill switch end usability without re-encrypting datasets — and deletion crypto-erases the original.
See tokenization on your own fields.
Bring one sensitive workflow. We will tokenize it live and show what your systems would store instead.