Replace sensitive values with encrypted PrivoNest PV1 tokens when your workflow needs authorized restoration later.
PV1.EMAIL.gAAAAA...
Protect now. Reveal only in an authorized path.
Tokens are emitted in the form PV1.<ENTITY_TYPE>.<FERNET_TOKEN>.
Hash/token transformations require a configured PII token secret; production deployments should use managed, versioned secret handling.
The /v1/reveal endpoint reverses only PrivoNest PV1 tokens for authenticated API users.
Reveal validates token payload version/type and can fail closed when strict mode is enabled.
Detokenization supports strings plus nested list/dictionary payloads.
Tokenization is one option alongside label, redact, partial, hash and remove; use irreversible strategies when restoration is unnecessary.