---
title: "Tokenization"
description: "Tokenization replaces sensitive values with placeholder tokens that map back through a separate vault. The standard pattern for routing prompts through third-party AI safely."
url: "https://sonomos.ai/glossary/tokenization/"
source: "https://sonomos.ai/glossary/tokenization/"
---

# Tokenization

Replacing a sensitive value with a non-sensitive token that maps back to the original through a separate, controlled lookup.

## In depth

Tokenization swaps a piece of sensitive data — say, a credit card number or a client name — for a placeholder token (e.g. ⟨CARD_3F12⟩). The mapping between token and original is kept in a separate vault that the receiving system never sees. Unlike encryption, the token itself carries no recoverable information; without the vault, it is meaningless. Tokenization is the standard pattern for processing payment card data under PCI DSS and increasingly for routing prompts through third-party AI models.

## Examples

- Replacing "555-12-3456" with "⟨SSN_A91⟩" in a prompt sent to ChatGPT.
- Tokenizing client matter numbers in a contract draft so the AI can reason about structure without seeing identifiers.
- Issuing a one-time token for a bank account when summarising a financial document.

## How Locke handles tokenization

Locke 1.0 replaces flagged data on-device with one-way placeholders before any prompt leaves your machine. There is no local token-to-value map that can restore the original today; reversible tokenization is planned shortly after 1.0.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Data Masking

  Replacing sensitive values with realistic-looking substitutes so the data remains usable while the originals never leave the device.
- Privacy Layer for AI

  A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Zero-Knowledge Processing

  An architecture where the service provider has no technical ability to read user data, because all sensitive processing happens on the client.

## Reading on this topic

- [What Is PII Redaction? A Plain-English Guide for AI Users](https://sonomos.ai/blog/what-is-pii-redaction-ai/)
- [How to Protect Sensitive Data When Using ChatGPT, Claude, and Gemini (2026 Guide)](https://sonomos.ai/blog/protect-sensitive-data-chatgpt-claude-gemini-2026/)