DEFINITION
Tokenization
Replacing a sensitive value with a non-sensitive token that maps back to the original through a separate, controlled lookup.
In depth
Tokenization swaps a piece of sensitive data — say, a credit card number or a client name — for a placeholder token (e.g. ⟨CARD_3F12⟩). The mapping between token and original is kept in a separate vault that the receiving system never sees. Unlike encryption, the token itself carries no recoverable information; without the vault, it is meaningless. Tokenization is the standard pattern for processing payment card data under PCI DSS and increasingly for routing prompts through third-party AI models.
Examples
- Replacing "555-12-3456" with "⟨SSN_A91⟩" in a prompt sent to ChatGPT.
- Tokenizing client matter numbers in a contract draft so the AI can reason about structure without seeing identifiers.
- Issuing a one-time token for a bank account when summarising a financial document.
How Locke handles tokenization
Locke 1.0 replaces flagged data on-device with one-way placeholders before any prompt leaves your machine. There is no local token-to-value map that can restore the original today; reversible tokenization is planned shortly after 1.0.
See the productRelated terms
- Data Masking
Replacing sensitive values with realistic-looking substitutes so the data remains usable while the originals never leave the device.
- Privacy Layer for AI
A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Zero-Knowledge Processing
An architecture where the service provider has no technical ability to read user data, because all sensitive processing happens on the client.
