ONE VALUE, ONE TOKEN — THE MAPPING STAYS IN YOUR VAULT
Your data center
Original value

+90 543 417 88 21  →  deterministic tokenizer  →  PHONE_8f3a

Same value · same scope · same token — every time
Token vault — the sovereign asset

PHONE_8f3a ↔ +90 543 417 88 21 · envelope-encrypted · your keys · every restore audited

tokens → ← response
Outside world
What the provider sees

Only PHONE_8f3a — a typed reference with no path back to the value.

the mapping is never sent

Typed: the category survives#

A Salus token carries its data class: PHONE_8f3a, IBAN_c21f, NAME_77b0. The external model knows it is looking at a phone number, an account, a person — it just doesn't know which one. That is usually all the reasoning task needs: summarize the complaint, draft the reply, classify the ticket.

Deterministic: relationships are preserved#

Tokenization is HMAC-backed and deterministic within a configured scope: the same subscriber number produces the same token throughout a conversation, a document, or — if you configure a wider scope — across an application. This is what keeps AI quality high. If a customer appears five times in a support thread, the model sees the same token five times and can connect the references, exactly as it would with the real value.

The scope is a policy decision, tunable between privacy (narrow scopes, tokens differ across contexts) and cross-channel consistency (wider scopes, the same entity is trackable across surfaces).

Reversible: the vault closes the loop#

The token-to-value mapping is stored in a vault inside your data center — Postgres, envelope-encrypted, with data keys wrapped by your KMS or HSM. When the provider's answer comes back containing tokens, the engine looks them up and restores the original values before the answer reaches the user. Every restore is an audited event.

The vault is deliberately the most sensitive asset in the system, which is why it lives on your infrastructure, under your keys, with no vendor access path.

What tokenization costs the model#

Honesty matters here: the model loses the value itself. Operations that need the real characters degrade — arithmetic on a tokenized amount, validating an IBAN's checksum, spell-checking a name. Three things bound this limit in practice:

  1. Policy decides what is tokenized. Identity classes (names, national IDs, phone numbers, account numbers) always mask. Numeric and quasi-identifying classes (amounts, dates) are configurable — many deployments pass amounts in the clear once identities are masked.
  2. Agent workloads compute inside anyway. In agentic flows the model orchestrates while tools execute — and tool execution runs inside your perimeter on restored values. Only the reasoning trace crosses the boundary, tokenized.
  3. What remains is documented, not hidden. Model-side arithmetic or format validation on a tokenized value does not work, and Salus says so.