What Types of Data Can I Tokenize with TokenEx?

Are you curious about what kind of data you can tokenize with TokenEx? This is a quick overview of tokenization and in-depth explorations of its use cases. Tokenization can be a great data security solution, especially for payment data and personal data.

When looking for a data security solution, it can be hard to keep track of the differences between tokenization and encryption. Which tool should you use for structured data or unstructured data? Which tool will maintain compliance with PCI (Payment Card Industry) or PII (Personally Identifiable Information) standards? To answer these questions, let’s look at a quick overview of how tokenization works.

Tokenization replaces sensitive data with “tokens” made of a non-sensitive data string. The data string is unrelated to the original, although it will match the formatting of the original to easily integrate into existing systems. The TokenEx tokenization tools are flexible, and they can even retain specific parts of the original data in the token to support functionality without compromising security.

Tokenization is different than encryption as it is unbreakable and irreversible. Because tokens are made of randomized data strings, they are useless if stolen. They cannot be returned to their original form, only exchanged for their true value. Because of this, even in the case of a data breach, sensitive information will remain secure.

Tokenization works well for payment data like credit card numbers, expiration dates, CVVs, CVCs, Bank account numbers, and routing numbers.

Tokenization keeps the original sensitive payment data in a secure cloud environment, replacing it in your system with a token. When you process a payment, the TokenEx system will swap the token for the original cardholder data, which will then be sent to the payment processor. With this system, your company will never have to store or manage real cardholder data.

Because your company never has to interact with the original data, the systems that handle and store tokens are no longer in scope for PCI DSS (Payment Card Industry Data Security Standards) compliance. The same cannot be said for encryption. Because encryption is reversible, systems storing encrypted data are still in scope. Further, encryption only protects data at rest, so it doesn’t offer the same flexibility and utility of tokenization. If you are looking for a way to secure cardholder data that simplifies PCI compliance and preserves the value of the original data, tokenization will be your best data security option.

Tokenization is optimal for personal data that has a fixed length or format, like Social Security numbers, driver’s license numbers, and other types of identification.

Forms of personal data with varying lengths (like names or email addresses) can be tokenized, but their length and format may be hard to retain as their formatting is inconsistent.

If you are looking to comply with privacy regulations, you will want to deidentify all personally identifiable information. PII (Personally Identifiable Information) is any information that can be used to identify a specific person. This includes data like names, home addresses, passport numbers, birthdays, social security numbers, email addresses, phone numbers, and IP addresses. TokenEx can tokenize most of these forms of data, identifying them in compliance with many common privacy regulations and keeping the original sensitive data secure even in the event of a data breach.

TokenEx specializes in tokenizing structured data, like Social Security numbers, and credit card numbers.

Both payment and personal data are examples of structured data, which TokenEx tools can secure. Tokenization is the best solution for structured data because the tokens can retain elements of the raw data, preserving much of its original value and utility. TokenEx’s flexible structured data tools will allow your company to choose which parts of the original data should remain in the token for internal purposes. Since most structured data is highly sensitive, tokenization is the best choice for secure storage and transmission.

TokenEx cannot tokenize unstructured data like images, emails, videos, or audio files.

While tokenization can secure structured data, encryption is a better choice for securing unstructured data. Unstructured data’s flexible formatting makes tokenization difficult. Because unstructured data does not fit into predefined fields, tokenization cannot keep consistent portions unscrambled to be used. Because these files are more complex, and usually needed in their entirety anyway, encryption is the best choice to secure these files.

TokenEx protects data at any point in its utility or storage. Let’s use a credit card number as an example of a tokenized piece of data. When a customer enters their information into your website, it is directly sent to TokenEx and replaced in your system with a placeholder token. This token can then be used to trigger the transfer of the original card data to any endpoint via TokenEx, without your company ever storing cardholder data.

Because of this system, cardholder data is secure for internal use as tokens have no inherent use if stolen. The original data can only be accessed with additional information that is securely stored outside of your environment. When in transit, the credit card’s data is transferred from the customer to the payment processor. The entire transit is done through the TokenEx secure gateways, which means that data in transit also remains secure.

Because different data types can use either tokenization or encryption, which one should you use? It depends on your priorities. Here are the key differences between tokenization and encryption:

• Encryption is reversible, and, therefore, still at risk if stolen
• Because encryption can be reversed, encrypted data is considered sensitive data by the PCI Security Standards Council
• While not as secure, encryption will work for either structured or unstructured data

• Tokenization is irreversible as tokens are unable to be used if stolen
• Because original data is kept in a safe separate location, the secured data is not compromised in a data breach
• TokenEx can secure any structured data, especially structured data with consistent formatting

When deciding between tokenization and encryption, identify the kind of data you need to be secured, the security standards you must remain compliant with, and the functionality you need from your data.

If you are looking to secure your sensitive data, especially for compliance with privacy regulations or the PCI DSS, TokenEx provides flexible tokenization to meet your company’s needs. TokenEx was founded by former PCI QSAs (Payment Card Industry Qualified Security Assessors). Our tools are specially designed to help reduce scope and help companies achieve PCI compliance. Whatever your structured data security needs are, TokenEx provides unrivaled flexibility and security for your sensitive data.