Replace sensitive values with encrypted PrivoNest PV2 tokens when your workflow needs authorized restoration later.
PV2.v1.EMAIL.gAAAAA...
Protect now. Reveal only in an authorized path.
Tokens are emitted in the form PV2.<KEY_VERSION>.<ENTITY_TYPE>.<FERNET_TOKEN>.
Hash/token transformations require a configured PII token secret; production deployments should use managed, versioned secret handling.
The /v1/reveal endpoint reverses only PrivoNest PV2 tokens only with separate reveal permission for the same company/app and authorized subject.
Reveal always checks company, app, subject, type, key version and expiry. Public reveal rejects old unscoped PV1 tokens.
Detokenization supports strings plus nested list/dictionary payloads.
Tokenization is one option alongside label, redact, partial, hash and remove; use irreversible strategies when restoration is unnecessary.