Docs / Concepts

Tokenization & vault

Replace PII with stable tokens for the model, then restore originals for the end user with the same vault map. Deeper design notes: Designing [EMAIL_n] tokens.

On this page+

Why deterministic

The same input value consistently maps to the same token (for example [CREDIT_CARD_1]) within a vault session, so debugging and support stay possible without sending raw PII to the model. When that value appears again in the same session, the vault reuses the placeholder — the outbound prompt stays less noisy, and your process can still unmask locally for the end user. Contrast with one-way redaction: see redaction vs masking vs tokenization.

Vault pattern

javascript
import { maskPii, unmaskPii } from '@noeticguard/core';

const vault = new Map();
const userInput = "Contact [email protected] about the new project.";
const masked = maskPii(userInput, { vault });
// masked.output -> "Contact [EMAIL_1] about the new project."

const llmResponse = `I drafted a note for ${masked.output}`;
const finalOutput = unmaskPii(llmResponse, vault);
// Restores [EMAIL_1] → [email protected] for the end user only.