Every layer of privacy infrastructure,in one platform.

Purpose-built vault types

Dedicated vaults for PII, PHI, PCI, and credentials. Each ships with sensible defaults so you do not have to design isolation from scratch.

Logical & physical tenancy

Choose multi-tenant for speed, single-tenant for compliance, or hybrid for regulated workloads — without rewriting your integration.

Field-level schemas

Declare which fields are sensitive, what tokenization preserves, and how to redact for analytics. The schema enforces it everywhere.

Data residency

Pin a vault to a region — US, EU, UK, Canada, or APAC — so GDPR, DPDP, PIPL, and data-sovereignty rules are satisfied at the storage layer.

Workspace-scoped policies

Inherit policies from the workspace, override at the vault, refine at the field. Auditable from the bottom up, easy to reason about from the top down.

AES-256-GCM at rest, TLS 1.3 in transit

Modern ciphers, audited libraries, no plaintext fallbacks. Keys are rotated automatically.

Customer-managed keys (BYOK)

Bring your own key from AWS KMS, Google Cloud KMS, Azure Key Vault, or HashiCorp Vault. Revoke access in one click.

Hold-your-own-key (HYOK)

For regulated workloads, keep the master key in your HSM. Without your approval, nobody — including PIIsafe — can read the data.

Envelope encryption per record

Every record is encrypted with a unique data key, wrapped by your master key. A leaked record never compromises the rest.

Scheduled & event-driven rotation

Rotate keys on a schedule, after staff offboarding, or on suspicion of compromise. Re-encryption is online and zero-downtime.

Format-preserving tokens

Tokens that look like credit cards, SSNs, or emails — so legacy systems and analytics tools keep working without code changes.

Reversible & irreversible modes

Reversible tokens for transactional flows, irreversible ones for analytics, and a clear policy for which is allowed where.

Detokenization at the edge

Detokenize only at the surface that needs the value — a payment processor, a doctor, a CSR — so plaintext never touches your servers.

Bulk operations

Batch tokenize migrations or detokenize for end-of-month exports without straining throughput or breaking audit trails.

Deterministic search

Optionally enable searchable tokens so your apps can still answer "do we already have this customer?" without ever decrypting.

Role-based access control

Built-in roles for engineers, support, finance, auditors, and admins — plus your own roles when those are not enough.

Attribute-based policies

Conditions on time of day, IP range, MFA strength, request purpose, or any custom claim. Policy lives next to data, not in a wiki.

Just-in-time access

Engineers request elevated access for a window, with a reason. Approvals are logged and access expires automatically.

Multi-sig for sensitive operations

Require two or more approvers before keys are exported, vaults are deleted, or audit logs are archived.

Break-glass access

Pre-approved incident workflows that grant access when on-call is paged — recorded, reviewed, and revoked automatically.

Tamper-evident audit log

Append-only log of every read, write, key operation, and policy change — chained so a single edit is detectable.

Live access dashboards

See in real time who is reading what, where the request came from, and which policy allowed it. Alerts on anomalies.

SIEM & data-warehouse export

Stream the audit log to Splunk, Datadog, Snowflake, or BigQuery so detection and retention live where your security team works.

Compliance evidence packs

SOC 2, HIPAA, GDPR, and ISO 27001 evidence assembled from real activity — not screenshotted policies — and updated continuously.

Data subject request automation

Search by subject, export their data, redact, or erase across vaults — with a signed report you can hand to a regulator.

Subject access in a single query

One subject ID, one search, every vault, every record. No more emailing engineering for every DSAR.

Right to erasure with accounting integrity

Cryptographic shredding of the data key — the record becomes mathematically unrecoverable while statistics survive.

Configurable retention windows

Set retention per vault and per field; PIIsafe destroys what you no longer need on the schedule you defined.

Consent capture & enforcement

Tie tokens to a consent record. If consent is withdrawn, downstream services lose detokenization access automatically.

REST & gRPC APIs

A clean, versioned API. Idempotent writes, consistent error shapes, and webhooks for everything that changes.

Typed SDKs

First-class SDKs for Node, Python, Go, Java, Ruby, and .NET. Strong types, sensible defaults, no surprises in production.

Drop-in PII proxy

Route an existing service through PIIsafe — sensitive fields are tokenized on the way in and detokenized on the way out, with zero code changes.

Local developer mode

A dev container that runs a real PIIsafe vault on your laptop, so the path from idea to PR never depends on the staging environment.

Cloud & infrastructure

AWS, GCP, Azure, HashiCorp Vault, Kubernetes — for KMS, IAM, networking, and deployments.

Identity & access

Okta, Auth0, Azure AD, OneLogin, plus SAML 2.0 and OIDC for any IdP that speaks them. SCIM for provisioning.

Data & analytics

Snowflake, Databricks, BigQuery, and Redshift — protect sensitive columns without breaking the warehouse.

Payments & fintech

Stripe, Adyen, Plaid, Braintree, Checkout.com, Worldpay — tokenize once, detokenize at the gateway.

Workflow & messaging

Zapier, Segment, Twilio, MuleSoft, Boomi — plus signed webhooks for everything else.

De-identification before training

Replace names, IDs, and contact info with stable tokens before data ever reaches a fine-tuning job. Re-identify only at inference.

Prompt-time redaction

A small SDK that scrubs PII out of prompts before they hit a third-party model and reinserts the right value into the response.

Vector store integration

Tokenize sensitive fields before they are embedded; retrieve and detokenize at the application layer with full audit.

Inference-time access control

The same policy engine that protects vaults gates access to model outputs — so leakage at inference is treated like leakage at storage.

99.99% target availability

Multi-AZ active-active deployments with automatic failover for cryptographic operations.

Region-pinned redundancy

Replicas, backups, and disaster-recovery copies stay inside the region you chose. No surprise cross-border traffic.

Incident transparency

Public status page, real-time updates, and post-incident reviews published when issues are resolved.

Change & dependency disclosure

Sub-processors, version changes, and dependency updates announced 30 days ahead — so your security review is not surprised.