Data Tokenization
Data Tokenization replaces a sensitive value with a token — a string with no mathematical relationship to the original value — and stores the encrypted original separately from the data source.
In this section
Section titled “In this section”- Vaulted Tokenization — Stores the encrypted original as a single entry in ALTR’s token vault.
- Critical Tokenization — Splits the encrypted original across separate, isolated storage locations, for the highest-sensitivity values.
Token Format
Section titled “Token Format”A token consists of a prefix and a globally unique identifier (GUID), for example vaultd_a1b2c3d4-e5f6-47a8-9b12-c3d4e5f6a7b8. The prefix identifies which tokenization variant and mode produced the token.
Applying Tokenization
Section titled “Applying Tokenization”ALTR does not tokenize data automatically. Tokenization is available through several paths:
- API. Tokenize values through the tokenization API, independent of Snowflake — data can be tokenized before it’s loaded into a data source.
- Manual. Call the tokenization function directly against data already in a connected data source.
- ETL-vendor integrations. Tokenize values as part of an ETL pipeline, using the tokenization function.
- User-defined function (UDF). Tokenize values through a user-defined function on supported data sources.
Applying Detokenization
Section titled “Applying Detokenization”Detokenization is available through several paths:
- API. Detokenize values through the tokenization API.
- Integration. Detokenize values as part of an integration, using the same API.
- UDF. Detokenize values through a user-defined function, for users granted direct access to it.
- Policy in Snowflake. Configure a masking policy with detokenization so authorized roles see the original value at query time. See Data Masking on Snowflake and Tokenization Access Policies.
PCI Compliance
Section titled “PCI Compliance”A token has no mathematical relationship to the original value it replaces. Because the token is a random substitute rather than a derivation of the original, systems that store or process tokens are not handling the original sensitive data — this is intended to remove tokenized columns from Payment Card Industry Data Security Standard (PCI DSS) scope.
For Snowflake-specific tokenization mechanics — tag connections and native versus external-function masking — see Data Masking on Snowflake.