AES-256 Encryption
All data encrypted at rest using AES-256-CBC with unique per-field initialization vectors. Files use AES-GCM with envelope encryption.
How Enigma Vault protects your data.
Anyone can encrypt a database. What matters is who holds the plaintext, who holds the keys, and what happens when something fails. Here is the answer, across every product.
PCI DSS Level 1
SOC 2 Type II
99.99% uptime SLA
AWS Partner
Security
Enterprise-Grade Protection
Every product is built with defense in depth. Every layer is designed around zero-trust principles.
Compliance
The Enigma Vault is a PCI DSS Level 1 Service Provider and SOC 2 Type II audited; NoPII and Triplets are built on it. Reduce your own audit scope by offloading sensitive data to us.
Per-Customer Keys
Per-customer AES-256 keys in a managed secrets store, rolled over after a specified time. No key is shared between customers.
Passkeys and MFA
Customer Vault staff sign in with passkeys or TOTP, and tenants can require MFA for every account.
Multi-Tenant Isolation
Tenant-scoped data, credentials and branding, with role-based access control, IP allowlist validation, and per-customer encryption keys.
Audit Logging
Every API request logged with client ID, IP, and response status. Customer Vault tracks all user activity through centralized audit trails.
The safest data is the data you never hold in the clear.
Across all three products, the real values live in the vault, never in your systems. Your application holds tokens, references, and audit logs. A breach of your stack exposes nothing worth stealing, because the thing worth stealing was never there.
Data encryption for fields and files.
Fields: AES-256-CBC
Structured data such as names, identifiers, and account numbers is encrypted at the field level, with exact-match lookup on encrypted values. You find a record by its value without decrypting the table.
Files: AES-GCM envelope encryption
Files up to 5GB are encrypted with authenticated encryption: a unique data key per file, wrapped by your account's own encryption key. Tampering is detectable. Access goes through short-lived presigned URLs.
Tokenization and tenant isolation.
Default tokens are generated by a cryptographically secure random number generator and encoded in Base64URL, carrying 128 bits of entropy. There is no algorithm to reverse and no structure to exploit, because the token contains no information. Optional format-preserving card tokens keep the first six and last four digits. The mapping lives only in the vault.
- ✓Deterministic tokens: the same value always maps to the same token, preserving database lookups and joins, and keeping AI reasoning consistent across a prompt
- ✓Field tokens with exact-match lookup on encrypted values
- ✓Card tokens that can pass Luhn validation, so existing checkout code keeps working
- ✓Tokenization powers all three products: stored fields in the Vault, and sensitive data in AI traffic through NoPII
Generated token
tok_8KQ2mZ4xR7nB1pV6wL0aYd
Follow the plaintext. It only lives in one place.
Triplets
Triplets governs how verified data becomes an answer. It models your corpus into structured stores of entities, relationships, and verified values, all built on the Enigma Vault. Unverified claims never reach the user, and answers carry provenance.
NoPII
NoPII tokenizes sensitive values in prompts before they reach the model provider and restores them on the response path. The model provider only ever receives tokens. The real values are held in the vault, never in provider logs.
Vault
The Vault holds cards, fields, files, and customer records under encryption, with your systems referencing them by token or handle.
Key management and audit logging.
Per-customer AES-256 keys in a managed secrets store, rolled over after a specified time. No key is shared between customers: your data is encrypted under keys that belong to you alone, and no engineer, yours or ours, handles key material by hand.
Per-customer keys
No key is shared between customers
Scheduled rollover
Keys roll over after a specified time
Managed secrets store
You never touch a key
Failure is designed, not hoped about.
Block, never leak
NoPII blocks any request it cannot tokenize, rather than forwarding it unprotected. That is architecture, not a setting.
Logged, always
Across all products, every access, tokenization, and retrieval is logged, so an audit is a query, not a project.
PCI DSS Level 1
SOC 2 Type II
BAA available
Security documentation.
Controls differ by data shape. See Card Vault for card tokens, Data Vault for field tokens, File Vault for encrypted objects, and NoPII architecture for the LLM request path.
The Enigma Vault is a PCI DSS Level 1 Service Provider, the highest level of payment data security certification, and SOC 2 Type II audited for security and availability. NoPII and Triplets are built on it. A 99.99% uptime SLA. BAA available for healthcare workloads on the Vault and on NoPII Enterprise. Distributed and billed through AWS Marketplace.