Tokenization
Swap sensitive data for a meaningless lookup token, so most of your system can use a reference without seeing the real value.
See it
What it is
Tokenization swaps a sensitive value for a meaningless token and keeps the real value in a separate vault. Your application stores and passes around something like tok_7f3a instead of a card number or national ID. When an authorized operation needs the original, it sends the token to the vault for a lookup.
Reach for it when most of a system needs to refer to sensitive data but very little of it needs to read that data. Payment processors use this pattern so a merchant can charge a saved card without storing the card number: Stripe hands back an identifier and keeps the digits, which is the whole reason most shops stay on the lightest PCI DSS questionnaire instead of the full one. It shrinks the number of databases, services, logs, and people exposed to the original value.
A token is not encryption or a hash. It has no useful mathematical relationship to the original value; detokenization depends on the mapping in the vault. That makes the vault both the control point and the prize. Lock down detokenization separately, audit every lookup, and do not let the token become a bearer credential that grants access by itself.
Ask AI for it
Build a token vault for the sensitive fields in this application. Use PostgreSQL's built-in gen_random_uuid() to issue opaque tokens, and store the original values only as ciphertext produced by AWS KMS Encrypt with an encryption context containing the tenant ID and field type. Expose separate tokenize and detokenize operations, require a dedicated IAM permission for AWS KMS Decrypt, enforce tenant ownership on every lookup, and write an audit event for every detokenization without recording plaintext. Replace sensitive values in application tables with foreign-keyed tokens, prevent tokens from authorizing an operation by themselves, and add tests proving that database dumps, logs, and API responses outside the authorized detokenization path contain no original values.