Critical Tokenization

Critical Tokenization is a variant of Vaulted Tokenization for the most sensitive data — such as Cardholder Data (CHD) and Social Security Numbers (SSNs) in Payment Card Industry (PCI) environments. Contact ALTR to enable Critical Tokenization.

Critical Tokenization produces tokens that look and behave the same as Vaulted Tokenization tokens. The difference is in how the original value is stored.

Deterministic and Non-Deterministic Modes

Critical Tokenization operates in the same two modes as Vaulted Tokenization. Non-deterministic mode (the default) produces a unique token each time the same value is tokenized, using the vaultn_ prefix. Deterministic mode produces the same token every time the same value is tokenized, using the vaultd_ prefix, which enables joins, lookups, and deduplication on tokenized values without detokenization.

Storage Model

Vaulted Tokenization stores the encrypted original as a single entry in ALTR’s token vault. Critical Tokenization instead splits the sensitive value across multiple isolated storage locations — a scattering step. No single storage location holds the complete original value.

The tokenization and detokenization flow is otherwise identical to Vaulted Tokenization: a value is submitted through the tokenization functions or API, and a token (a prefix and globally unique identifier (GUID), for example vaultd_<guid>) is returned. Retrieval reassembles the scattered pieces transparently — the admin does not manage the scattering directly.

Tokenization is available multi-region by default, for high availability.

Masking Policies with Detokenization

The same three-level masking policy with detokenization model as Vaulted Tokenization applies — Token-Only Access, Masked Detokenization, and Full Detokenization. See Tokenization Access Policies for the access model.

Shared Behavior with Vaulted Tokenization

Everything else behaves the same as Vaulted Tokenization:

• Bring Your Own Key (BYOK). BYOK is available under the same model as Vaulted Tokenization. See Vaulted Tokenization BYOK.

• Data source support. Available on Snowflake through the masking policy framework. See Data Masking on Snowflake for the underlying Snowflake mechanics.