The product
The four vaults
Data Vault is a searchable field-level encryption API. It encrypts personal data, secrets, and identifiers with AES-256 and supports exact-match lookup on encrypted values. Your database holds tokens. Your lookups keep working. The plaintext lives in the vault.
The trade-off
Full-field encryption usually kills search, so teams encrypt the disk instead, leave the fields readable, and hope access controls hold. That protects against a stolen hard drive and nothing else.
Fields are encrypted with AES-256 using unique per-field initialization vectors, with exact-match lookup on encrypted values, so the workflows that depend on those fields never break.
Free tier
1,500 requests a month free, without a contract.
The API
Two calls. Store the token anywhere, because it contains nothing.
Step 1 · Authenticate
TOKEN=$(curl -s -X POST https://api-auth.enigmavault.io/oauth2/token \ -u "$CLIENT_ID:$CLIENT_SECRET" \ -d "grant_type=client_credentials" \ -d "scope=io.enigmavault/datavault" | jq -r .access_token)
Step 2 · Store a secret
curl -X POST https://api.enigmavault.io/datavault/secrets \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '[{"plaintext":"123-45-6789"}]'
[{ "token": "Ry0Ixd1qP8vKmN3aBcDeFg", "customIdentifier": null }]Store that token in the column where the SSN used to be. Retrieve it, look up exact matches on encrypted values, or batch up to 5,000 secrets in a single request.
Capabilities
New to tokenization? Start with the Vault overview.
Exact-match lookup on encrypted values: find a record by its value while the stored data stays ciphertext. A breach of your database yields a table of tokens that reference nothing.
The same value always produces the same token, so lookups, joins, and deduplication keep working. It is also the property that lets NoPII keep AI reasoning coherent, because NoPII runs on this infrastructure.
Migrations and enrollment surges run as batch calls, not scripts that run all weekend.
Attach your own record IDs to every secret, so vault entries map cleanly onto your existing data model.
Share specific secrets across clients with one-time-use, time-limited keys that expire and self-destruct after use. No standing access to revoke later.
Because the real value lives only in the vault, erasure resolves there. Tokens left behind in your systems reference nothing.
Integration
One REST call from any language. No SDK required.
Security posture
AES-256-CBC at the field level, with a unique initialization vector per field. Nothing is encrypted twice the same way.
Per-customer AES-256 keys in a managed secrets store, rolled over after a specified time. No key is shared between customers, and you never touch one.
128 bits of entropy, Base64URL-encoded, generated by a CSPRNG. No structure to reverse, no algorithm to attack.
Every request authenticated with OAuth2 machine-to-machine credentials and logged with client ID, IP, resource path, and response status, with full distributed tracing.
Where it lands
The pattern is always the same: a column your application needs to search, holding a value you would rather not be holding.
SSNs, account numbers, and identifiers your application still needs to search.
Values that should never sit in plaintext next to application data.
Tokenize at capture and GDPR, CCPA, and DPDP deletion resolves at the vault instead of across every backup.
Diagnoses, prescriptions, and lab results encrypted at the API level while non-sensitive metadata stays searchable.
