Secure sensitive data

[!IMPORTANT]
Documentation Update: Product documentation, which were located in this repository under /website, are now located in hashicorp/web-unified-docs, colocated with all other product documentation. Contributions to this content should be done in the web-unified-docs repo, and not this one. Changes made to /website content in this repo will not be reflected on the developer.hashicorp.com website.

Encrypt data

Use Vault to deploy encryption as a service and move the burden of data encryption/decryption from your applications to Vault.

With the transit plugin, Vault can encrypt and decrypt external data, essentially allowing applications to encrypt their data while storing it in the primary data store, which simplifies encrypting data in transit and at rest across clouds and datacenters.

Tokenize data

Use Vault to securely transform and tokenize input data with NIST vetted cryptographic standards such as format-preserving encryption (FPE) via FF3-1 and pseudonymous transformations like data masking.

With the transform plugin, Vault can perform one-way transformations that exchange sensitive values for unrelated, stateful tokenized values. Tokenization makes the original value unrecoverable from the token alone. Authorized clients must submit the token to Vault to retrieve the original value from a cryptographic mapping in storage.