How Data Tokenization Protects Sensitive Financial Data
One of the biggest challenges I see is that organizations don’t always have a clear understanding of their data. A mature data dictionary, for example, explains what the different elements of your data represent and establishes provenance. Without that foundation, it is much harder to know what data you have, where it came from and how to protect it.
That is why leadership commitment matters. Data security and risk management must be owned at the top and incorporated into the risk register and technology roadmap. Otherwise, organizations may get impressive answers from AI systems but struggle to show how those answers were produced or whether the underlying data can be trusted.
How Tokenization Works
Tokenization offers one way to address that challenge. It has roots in the payment card industry, where organizations needed to protect primary account numbers without making sensitive information broadly accessible.
READ MORE: The Segment of One is coming to banking. Is your data ready?
The concept is straightforward: Instead of exposing the sensitive value, the organization uses a token that represents it. An authenticated request can use that token to query a secure data set and retrieve only the information authorized for that transaction.
Modern tokenization doesn’t simply open the door to a database and let someone extract rows and columns. It can provide fine-grained access control, role-based authentication, revocability and provenance. For example, someone in accounting might be authorized to see real data, while a data scientist works only with masked or obfuscated information.
That result is a more controlled way to make sensitive data useful without unnecessarily exposing it.
Scaling Financial AI Safely With Format-Preserving Tokenization
For financial institutions, getting there isn’t easy. Many organizations still rely on decades-old systems, mainframes, custom databases and technology inherited through acquisitions. Retention requirements and legacy infrastructure make it difficult to modernize everything at once.
DISCOVER: How can AI projects improve in financial services?
That’s where approaches such as Capital One’s Databolt become particularly interesting. One of its most compelling capabilities is format preservation.
What Format Preservation Does
When sensitive information is tokenized, preserving the characteristics of the original data makes it much easier for downstream systems to work with it. An email address can still look like an email address, and a ZIP code can retain its recognizable format. Organizations don’t necessarily have to build complicated transformation and translation processes around the data before they can use it.
Format-preserving tokenization supports AI initiatives in two key ways:
- Simpler data pipelines. Data pipelines can become a significant source of complexity. The closer tokenized data stays to the structure and characteristics of the source data, the easier it is to use without creating additional ingestion and transformation challenges.
- Performance and scalability. Traditional approaches can create bottlenecks when a large volume of queries must repeatedly reference a secure data store. Modern tokenization architectures are designed to support higher-frequency querying while maintaining authorization and resiliency.
Moving Toward “Assume Secure”
Ultimately, we want to move toward an environment where organizations can confidently share the data necessary for a particular function or query, including with trusted third parties, while maintaining security and control.
GET THE DETAILS: Cybersecurity automation can better support financial services.
I see that as an important part of the shift from an “assume compromise” mindset toward “assume secure.” We aren’t there yet, particularly given the amount of legacy technology financial institutions must continue to support. But architecture, software and organizational commitment are finally beginning to move in the same direction.
This matters beyond financial services. The same principles apply wherever organizations need to protect sensitive personal, financial or health information while keeping that data useful. Tokenization can become an important piece of a broader AI and data-governance strategy, provided organizations treat it as part of a long-term business and risk strategy, rather than simply another shiny object.
This article is part of BizTech's EquITy blog series.
