AWS Cognito vs Databunker Pro — PII Vault & Tokenization

​

Authentication is now an afternoon, not a project

​

What auth doesn’t solve — and Databunker Pro does

• Where do you store your users’ PII so it isn’t exposed in logs, backups, or a SQL injection?
• How do you tokenise credit-card numbers to shrink PCI scope?
• How do you fulfil a GDPR / DPDPA right-to-erasure request across every system that holds the user’s data?
• How do you prove to an auditor that every PII access was authorised and logged?
• How do you keep Indian users’ PII in India, Russian users’ PII in Russia, and EU users’ PII in the EU — all simultaneously?

• PII Vault — AES-256 per-record encryption; the application stores only UUID tokens, never PII.
• Format-preserving tokenization — Luhn-valid credit-card tokens, integer tokens, timestamp tokens. Real PCI-scope reduction.
• Consent management — legal-basis tracking, user agreements, processing-activity records aligned with GDPR / DPDPA.
• DPO operations — DSAR fulfilment, right-to-erasure, data-portability via the separate Databunker DPO product.
• Audit trail — per-record, per-field, with encrypted PII context. See Access control.
• Multi-tenancy — PostgreSQL row-level security; cryptographic per-domain isolation.
• Record versioning — immutable history for every user record.
• Fuzzy search — typo-tolerant search on encrypted data.
• Shared records — time-limited UUID references for safe cross-system sharing.
• Shamir secret sharing — master-key recovery split across multiple custodians.
• BYOK / HYOK — wrapping key in Kubernetes secret, AWS KMS, HashiCorp Vault, or hardware HSM.
• Multi-jurisdiction deployment — one vault per jurisdiction (India, Russia, Turkey, EU, etc.) — a topology Cognito cannot match because Cognito is AWS-bound.
• Self-hosted — deploy on any cloud, on-premises, in a sovereign region, or inside a customer’s tenant.
• Predictable pricing — per-instance license, flat regardless of user count. No per-MAU bill.

​

Reference architecture

   [ User ] ─── sign-in ───► [ Your auth layer (NextAuth / Lucia / Ory / Keycloak / ...) ]
                                                  │
                                       Built once with LLM assistance.
                                       Issues JWT / session.
                                                  │
                                                  ▼
                                       [ Your application ]
                                                  │
                                                  ▼
                                       [ Databunker Pro ]
                                       AES-256 encrypted vault
                                       Tokenization · CRBAC · audit
                                       Self-hosted, any region

​

Comparison table

​

Migration from Cognito

1. Stand up Databunker Pro in your target environment (Docker / Helm).
2. Build the replacement auth layer in your codebase using an LLM and the library of your choice (NextAuth, Lucia, Ory, Keycloak, etc.). Wire it to Databunker Pro for the user record.
3. Export the Cognito user list — emails, attributes, group memberships — via ListUsers.
4. Bulk-import into Databunker Pro using UserCreateBulk — at ~1,700 records/sec on a single instance, a typical Cognito directory imports in minutes.
5. Migration window: switch the auth layer to your replacement and force a one-time password reset email to every user (unavoidable — Cognito does not expose hashes).
6. Decommission the Cognito user pool once the population has migrated.

​

Code examples

​

Sign-up: auth in your codebase, PII in Databunker

// 1. User signs up via your auth layer (NextAuth / Lucia / Ory / etc.)
//    Your auth issues a session and gives you the verified email.

// 2. Store PII in Databunker — get back a safe UUID token
const response = await axios.post('https://your-databunker/v2/UserCreate', {
  profile: {
    email:   form.email,
    first:   form.firstName,
    last:    form.lastName,
    phone:   form.phone,
    address: form.address,
    dob:     form.dateOfBirth,
  }
}, {
  headers: { 'X-Bunker-Token': process.env.DATABUNKER_API_KEY }
});

const userToken = response.data.token;

// 3. Store only (userId, userToken) in your app DB — zero PII anywhere outside the vault
await db.query(
  'INSERT INTO users (id, databunker_token) VALUES ($1, $2)',
  [authUser.id, userToken]
);

​

Format-preserving credit-card tokenization

curl -X POST https://your-databunker/v2/TokenCreate \
  -H "X-Bunker-Token: YOUR_API_KEY" \
  -d '{
    "record": "4532015112830366",
    "tokentype": "creditcard",
    "slidingtime": "30d",
    "unique": true
  }'

{
  "status": "ok",
  "tokenuuid": "550e8400-e29b-41d4-a716-446655440000",
  "tokenbase": "4024007186539112"
}

​

The bottom line

​

Next steps

• Migrate from AWS Cognito — export the pool, import into the vault, cut over authentication
• Quickstart — a running vault and a first API call from one docker run
• Licensing and limits — what a record is, and what the licence caps