PII Vault - PII Storage & Tokenization in Databunker Pro

The PII Vault stores and tokenizes personal data (PII, PHI, KYC, PCI) so it never sits in your application database. When sensitive data enters your system, Databunker instantly encrypts, tokenizes, and stores it in a secure vault. You get back a safe token to store anywhere — even in public databases. You can run Databunker in the cloud or on-premises, you can enable your enterprise customers to self-host their PII vault in any region, which solves PII export restrictions and reduces compliance risk.

What is a PII Vault?

The PII Vault is Databunker Pro’s core feature that transforms how organizations handle sensitive personal data. Instead of storing PII directly in your application database, the PII Vault:

Encrypts and tokenizes entire user records using AES-256 encryption
Generates secure UUID tokens that can be safely stored anywhere
Maintains searchable indexes using secure hash-based lookups
Provides audit trails for every data access and modification
Enables compliance with GDPR, HIPAA, SOC2, and other privacy regulations

Why Use PII Vault Instead of Regular Database Tables?

Traditional Database Approach Problems

-- Traditional approach: PII stored in plain text or basic encryption
CREATE TABLE users (
    id SERIAL PRIMARY KEY,
    email VARCHAR(255),           -- Exposed in logs, backups, queries
    first_name VARCHAR(100),      -- Visible to all database users
    last_name VARCHAR(100),       -- Accessible via SQL injection
    phone VARCHAR(20),            -- Stored in application logs
    ssn VARCHAR(11),              -- High-risk data exposure
    created_at TIMESTAMP
);

Issues with this approach:

❌ Data exposure in logs, backups, and error messages
❌ SQL injection vulnerabilities expose sensitive data
❌ Database admin access reveals all personal information
❌ Compliance complexity requires extensive additional controls
❌ Breach impact exposes all stored PII immediately

Databunker Pro PII Vault Solution

Instead of storing PII in your application database, store only the user secure tokens (in UUID format):

-- Modern approach: Only tokens stored in application database
CREATE TABLE users (
    id SERIAL PRIMARY KEY,
    user_token UUID              -- Safe to store anywhere
);

Benefits of this approach:

✅ Zero PII exposure in application databases, logs, or backups
✅ Breach protection - attackers only see meaningless tokens
✅ Built-in compliance with privacy regulations
✅ Simplified architecture - no complex encryption management
✅ Audit-ready with comprehensive access logging

How PII Vault Works

1. Data Ingestion and Tokenization

When sensitive data enters your system, Databunker Pro:

Accepts complete user profiles in JSON format
Extracts searchable fields (email, phone, login, custom) for indexing
Encrypts the entire record using AES-256 encryption
Generates a secure UUID token for the record
Stores encrypted data in the secure vault
Creates hashed search indexes for efficient lookups

2. Uniqueness and identity resolution

The hashed search indexes on email, phone, login, and custom are unique within a tenant. This has three practical consequences:

Duplicates cannot coexist inside the same tenant. A second attempt to create a user record under an existing email / phone / login / custom value is rejected at the vault level — identity uniqueness is a structural guarantee, not a discipline.
Repeat identities resolve to the same token. When the same person appears again, look them up by their indexed field and reuse the existing token; there is no risk of accidentally minting two tokens for the same underlying identity.
Different tenants can hold their own record for the same person. Tenants are cryptographically isolated boundaries (enforced with PostgreSQL row-level security, and also supported on MySQL and Oracle), so the same email tokenised in two tenants produces two different tokens — this is the basis of the multi-tenant, multi-token pattern used for separating analytics, operational, and external-integration domains.

Together, these properties mean that tokens within a tenant are stable, deterministic join keys — SQL queries that previously joined on email can join on user_token with no round-trip to the vault.

3. Secure Storage Architecture

Code Examples: Storing and Retrieving User Records

Storing User PII

cURL
JavaScript
Python

curl -X POST https://your-databunker-pro/v2/UserCreate \
  -H "X-Bunker-Token: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "profile": {
      "email": "john.doe@example.com",
      "first": "John",
      "last": "Doe",
      "phone": "+1-555-123-4567",
      "ssn": "123-45-6789",
      "address": "123 Main St, City, State 12345",
      "dob": "1985-06-15"
    }
  }'

Response:

{
  "status": "ok",
  "token": "a21fa1d3-5e47-11ef-a729-32e05c6f6c16"
}

const axios = require("axios");

async function storeUserPII(userData) {
  try {
    const response = await axios.post(
      "https://your-databunker-pro/v2/UserCreate",
      {
        profile: {
          email: userData.email,
          first: userData.firstName,
          last: userData.lastName,
          phone: userData.phone,
          ssn: userData.ssn,
          address: userData.address,
          dob: userData.dateOfBirth,
        },
      },
      {
        headers: {
          "X-Bunker-Token": process.env.DATABUNKER_API_KEY,
          "Content-Type": "application/json",
        },
      }
    );

    return response.data.token; // Store this token in your database
  } catch (error) {
    console.error("Error storing user PII:", error);
    throw error;
  }
}

// Usage
const userToken = await storeUserPII({
  email: "jane.smith@example.com",
  firstName: "Jane",
  lastName: "Smith",
  phone: "+1-555-987-6543",
  ssn: "987-65-4321",
  address: "456 Oak Ave, City, State 54321",
  dateOfBirth: "1990-03-22",
});

import requests
import json

def store_user_pii(user_data):
    url = "https://your-databunker-pro/v2/UserCreate"
    headers = {
        "X-Bunker-Token": "YOUR_API_KEY",
        "Content-Type": "application/json"
    }

    payload = {
        "profile": {
            "email": user_data["email"],
            "first": user_data["first_name"],
            "last": user_data["last_name"],
            "phone": user_data["phone"],
            "ssn": user_data["ssn"],
            "address": user_data["address"],
            "dob": user_data["date_of_birth"]
        }
    }

    response = requests.post(url, headers=headers, json=payload)
    response.raise_for_status()

    return response.json()["token"]

# Usage
user_token = store_user_pii({
    "email": "mike.johnson@example.com",
    "first_name": "Mike",
    "last_name": "Johnson",
    "phone": "+1-555-456-7890",
    "ssn": "456-78-9012",
    "address": "789 Pine St, City, State 67890",
    "date_of_birth": "1988-11-08"
})

Retrieving User PII

Retrieve by Token
Retrieve by Email
Retrieve by Phone

curl -X POST https://your-databunker-pro/v2/UserGet \
  -H "X-Bunker-Token: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "token",
    "identity": "a21fa1d3-5e47-11ef-a729-32e05c6f6c16"
  }'

curl -X POST https://your-databunker-pro/v2/UserGet \
  -H "X-Bunker-Token: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "email",
    "identity": "john.doe@example.com"
  }'

curl -X POST https://your-databunker-pro/v2/UserGet \
  -H "X-Bunker-Token: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "phone",
    "identity": "+1-555-123-4567"
  }'

Security controls

Records are encrypted with AES-256, access is governed by role-based policies, and every request is written to the audit trail. Tenants are isolated at the database level on PostgreSQL, and the application tier scales horizontally. See the Security overview for the full control set.

Next steps

Quickstart — run a vault and store your first record in one command
Search the vault — exact, fuzzy, and partial lookups over encrypted records
Tokenize credit cards — format-preserving tokens for PCI data
Performance and sizing — measured throughput and instance sizing by record count
Licensing and limits — what counts as a record

Get started

Installation

Administration

Concepts

Comparisons

Migrations

How-tos

Developer tools

PII Vault - PII Storage & Tokenization in Databunker Pro

What is a PII Vault?

Why Use PII Vault Instead of Regular Database Tables?

Traditional Database Approach Problems

Databunker Pro PII Vault Solution

How PII Vault Works

1. Data Ingestion and Tokenization

2. Uniqueness and identity resolution

3. Secure Storage Architecture

Code Examples: Storing and Retrieving User Records

Storing User PII

Retrieving User PII

Security controls

Next steps

​What is a PII Vault?

​Why Use PII Vault Instead of Regular Database Tables?

​Traditional Database Approach Problems

​Databunker Pro PII Vault Solution

​How PII Vault Works

​1. Data Ingestion and Tokenization

​2. Uniqueness and identity resolution

​3. Secure Storage Architecture

​Code Examples: Storing and Retrieving User Records

​Storing User PII

​Retrieving User PII

​Security controls

​Next steps

What is a PII Vault?

Why Use PII Vault Instead of Regular Database Tables?

Traditional Database Approach Problems

Databunker Pro PII Vault Solution

How PII Vault Works

1. Data Ingestion and Tokenization

2. Uniqueness and identity resolution

3. Secure Storage Architecture

Code Examples: Storing and Retrieving User Records

Storing User PII

Retrieving User PII

Security controls

Next steps