The product
The four vaults
Enigma Vault is a data tokenization API that holds your customers’ most sensitive data, so a breach of your systems exposes nothing worth stealing. Cards, personal data, files, and customer intake, all behind one API, with millions of secrets already encrypted and zero plaintext stored.
PCI DSS Level 1 · SOC 2 Type II · BAA available · 99.99% uptime SLA · AWS Partner
Every record of card numbers, personal data, and sensitive files you store is a breach waiting to become someone's headline, and an audit scope that grows every year. The safest data is the data you never hold in the clear.
Most teams bolt a tokenization vendor to an encrypted-storage tool to a homegrown intake form. Three integrations, three audits, three bills, and the seams between them are where data leaks.
Enigma Vault is one trust layer, one integration, one compliance boundary.
Free tier
Free allowances are available for Card Vault, Data Vault, File Vault and NoPII. Customer Vault, Agent Vault and Triplets are priced by engagement. See Vault pricing.
Each vault solves a different shape of the same problem: holding sensitive data so you do not have to. Use one, or use them together through a single integration. Each has its own page with full depth.
Accept payments without ever holding a card. Cards are tokenized at capture through hosted forms, Twilio Pay IVR, or the API, then charged through any gateway via our proxy: Authorize.net, Stripe, Braintree, PayPal, or any REST processor. Optional Luhn-passable tokens, CVVs held encrypted for at most 30 minutes then deleted, and one way in with no way out except through our proxy.
Encrypt any field. Still look it up. AES-256 field-level encryption with exact-match lookup on encrypted values, deterministic tokens that preserve lookups and joins, batch operations up to 5,000 secrets per request, custom identifiers, and ephemeral key sharing across clients.
Store any file. Hand out access that expires. Encrypted object storage from kilobytes to 5GB under AES-GCM envelope encryption, with presigned upload and download URLs, real-time file status over WebSocket, and a full audit trail on every touch.
Collect sensitive data without building a thing. A turnkey, branded intake app that replaces fax and email: no-login links, a staff inbox, secure file sharing, e-signatures, custom sensitive fields, and staff sign-in with passkeys or TOTP. Live the same day, with a full lifecycle API and webhooks when you want them.
Developer-first REST API. Two-line integration. Your developers ship in a day, not a quarter.
AES-256-CBC fields with unique per-field initialization vectors, AES-GCM envelope encryption for files, and per-customer AES-256 keys in a managed secrets store, rolled over after a specified time.
OAuth2 machine-to-machine auth, per-tenant IP whitelisting, full audit logging with distributed tracing, CSPRNG tokens with 128-bit entropy.
One-time-use ephemeral keys that expire and self-destruct.
A versioned REST API, a live Swagger UI at api.enigmavault.io, and examples on GitHub.
The sensitive data lives in the vault, not your database.
Integration
Two calls to a token. The Swagger UI is live at api.enigmavault.io.
Government agencies encrypting tax and justice records. Healthcare teams meeting HIPAA at the field level, with a BAA available. Financial platforms tokenizing cards without PCI scope in their codebase. Universities protecting student records through enrollment surges. Law firms, insurers, and enterprises of every size, starting free and scaling on the same certified infrastructure.
Spin up a vault on AWS Marketplace, move your sensitive data behind it, and watch your breach exposure and audit scope shrink. No contract to start.
The real values live in the vault. Your systems hold tokens, references, and audit logs. This page covers the mechanics every vault shares; each vault’s own page covers its specifics.
The integration
A straightforward REST API from any language or platform. No SDK required.
01
Get an OAuth2 access token with your client credentials and per-vault scopes.
02
Send your sensitive data to the vault. We encrypt it with AES-256 and return a token you can safely store anywhere.
03
Use tokens to retrieve data, look up exact matches on encrypted values, or charge cards through your gateway without ever touching raw data.
Step 1 · Authenticate
TOKEN=$(curl -s -X POST https://api-auth.enigmavault.io/oauth2/token \ -u "$CLIENT_ID:$CLIENT_SECRET" \ -d "grant_type=client_credentials" \ -d "scope=io.enigmavault/datavault" | jq -r .access_token)
Step 2 · Store a secret
curl -X POST https://api.enigmavault.io/datavault/secrets \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '[{"plaintext":"123-45-6789"}]'
[{ "token": "Ry0Ixd1qP8vKmN3aBcDeFg" }]Free tier
Card, Data and File Vault each have a free tier on AWS Marketplace.
The suite
Tokenize payment cards through hosted forms, Twilio Pay IVR, or the API, and charge through any REST gateway via our proxy. Optional Luhn-passable tokens; CVVs held encrypted for at most 30 minutes, then deleted.
AES-256 field-level encryption with exact-match lookup, deterministic tokens, batch operations to 5,000 secrets, custom identifiers.
Files to 5GB under AES-GCM envelope encryption, presigned URLs, real-time status over WebSocket.
Turnkey branded intake with a staff inbox, file sharing, e-signatures, and a full lifecycle API with signed webhooks.
The foundation
AES-256-CBC for fields with unique per-field initialization vectors, AES-GCM envelope encryption for files. You never touch a key.
Per-customer AES-256 keys in a managed secrets store, rolled over after a specified time. No key is shared between customers.
CSPRNG, Base64URL, 128 bits of entropy. No structure to reverse. Card tokens can optionally preserve format.
One-time-use, time-limited keys for cross-client sharing that expire and self-destruct after use.
OAuth2 machine-to-machine authentication on every surface, per-tenant IP whitelist validation, and multi-tenancy isolation by client ID.
Every request logged with client ID, IP address, resource path, and response status, with distributed tracing end to end.
Before you write code
Nothing here is a mock. The Swagger UI is the running API, and the card demo tokenizes a real test card in your browser.
Every endpoint of the versioned REST API, browsable and callable at api.enigmavault.io.
Working code on GitHub, so the first call is copy-paste rather than guesswork.
THE VAULT · USE CASES
Data tokenization use cases, drawn from the deployments we see most, with no names attached.
CASE 01 · CARD VAULT
The most common Vault story is a mid-market software platform, fintech, travel tech, e-commerce enablement, vertical SaaS, whose product roadmap arrived at payments. Merchants want card-on-file. Recurring billing is the business model. And suddenly a software company is staring at PCI DSS scope across its entire stack, or at a processor's vault that solves storage by taking the card data hostage.
Card Vault splits the difference the roadmap needs: cards are captured on hosted forms, stored as Luhn-passable tokens that existing checkout code accepts without modification, and charged through our proxy to whichever gateway the platform or its merchants already use. The platform offers payments. The vault carries the custody. Switching processors later is a configuration change, because the cards never lived with the processor in the first place. This is also the standard expansion path we see: teams arrive for Card Vault, then move personal data behind Data Vault through the same integration once the pattern proves itself.
Explore Card VaultCASE 02 · AGENT VAULT
A different shape of the same problem appears in operations businesses: private aviation, cruise lines, member clubs, dental groups, home services. Cards on file are the operating model, collected over years, across booking channels and phone calls, living in spreadsheets, legacy systems, and payment terminals nobody fully trusts. One deployment in private aviation is representative: existing cards imported into the vault in bulk, a branded card-management experience for account holders, staff access behind enterprise single sign-on, and every charge routed through the operator's existing processor. The cards moved into certified custody; the operation did not change.
This is the pattern Agent Vault productizes: a fixed-scope, eight-week engagement that takes a card-on-file operation from scattered custody to vaulted custody, including the migration. For phone-heavy operations, Twilio Pay capture tokenizes cards straight from the IVR, so a number is never spoken to a screen.
Ask about Agent VaultCASE 03 · DATA VAULT
Somewhere in almost every company sits a table that keeps the compliance team up at night: SSNs, account numbers, national IDs, salary data. Encrypting it wholesale breaks the application that searches it, so it stays readable, protected by access controls and optimism.
Data Vault ends the standoff. Fields are encrypted with AES-256 and still support exact-match lookup; deterministic tokens preserve lookups, joins, and deduplication; batch operations at up to 5,000 secrets per request make the migration a weekend, not a quarter. The application keeps behaving as if the data were there. The breach report, if it ever comes, describes a table of tokens that reference nothing. This is the same infrastructure NoPII runs on, which is why AI traffic and stored data can share one custody story.
Explore Data VaultCASE 04 · FILE VAULT
Contracts, IDs, medical records, tax documents: they arrive by email because email is easy, and then they live in inboxes, backups, and forwarded threads forever. Every mailbox becomes an unencrypted archive of exactly what a regulator cares about.
File Vault takes the document out of the stack: files up to 5GB encrypted with AES-GCM envelope encryption, uploaded and downloaded through short-lived presigned URLs, with real-time status over WebSocket and every touch logged. For sharing across teams, clients, or outside counsel, ephemeral keys grant one-time, time-limited access that self-destructs after use. The recipient gets the file. Nobody gets a permanent door.
Explore File VaultCASE 05 · CUSTOMER VAULT
Clinics collecting insurance cards and consents. Law and tax firms receiving W-2s, retainers, and case files. Property managers processing applications with IDs and deposit payments. Travel agencies holding passports. The team knows email is the wrong channel; the engineering roadmap has no room for a portal.
Customer Vault is the no-code answer: branded, no-login intake links that collect cards, files, signatures, and custom sensitive fields; a shared inbox where staff assign submissions to customer profiles; file sharing through expiring, password-protected links; passkey or TOTP sign-in for staff, with MFA tenants can require for every account. Live the same day, no developer involved, and a full lifecycle API with signed webhooks waiting whenever engineering wants to connect it. It is the fastest path from "we still use fax" to "everything is encrypted and logged," and it is how non-technical teams start with the platform before their engineering counterparts ever write a line.
Explore Customer VaultCASE 06 · RIGHT TO ERASURE
GDPR, CCPA, and DPDP grant deletion rights, and every request lands on the same ugly reality: identifiers scattered across databases, backups, and logs, each one an excavation. When values are tokenized at capture, the real data lives in exactly one place. Erasure resolves at the vault; tokens left behind reference nothing; the response to "where does this person's data live" becomes a sentence instead of an investigation.
CASE 07 · ONE FOUNDATION
The pattern before the Vault is always the same: a tokenization vendor, an encrypted-storage tool, a homegrown intake form, three integrations, three audits, three bills, and gaps hiding at every seam. Card, Data, File, and Customer vaults share one API, one compliance boundary, and one audit trail, so consolidation is a subscription change, not a migration. One vendor, one invoice, one audit, and no seams for data to leak through.
See pricingTax records, justice data, license information, and HR files encrypted at the field level, with per-department scopes and distributed tracing across agencies.
EHR and EMR fields, diagnoses, prescriptions, lab results, encrypted at the API level to meet HIPAA while non-sensitive metadata stays searchable, and patient intake handled without fax or email.
Student records and financial aid data batch-encrypted through enrollment surges, transcripts and IDs in File Vault with expiring access.
Cards tokenized and charged through any gateway without PCI scope in the codebase; ACH data, account numbers, and loan documents vaulted under per-customer keys.
Case files and privileged material encrypted at the field level, signed documents stored with complete access history, sharing across counsel via ephemeral keys.
Policyholder data, claims documents, and premium payment cards across lines of business, with encrypted search and gateway proxy for recurring premiums.
Cards, IDs, and documents collected across locations and channels through Customer Vault, with corporate cards on file for recurring operations.
The same certified infrastructure runs from the free Lite tier to the largest enterprise deployments, with per-customer keys at every tier, because security was never the tier.
