A communications platform must reduce the systems handling customer phone numbers and message content. Tokenisation or field-level encryption?

What each gives you

Tokenisation replaces the sensitive value with a surrogate that has no mathematical relationship to it. The real value lives in one vault; everything else holds tokens. Downstream systems are genuinely out of scope because a token is not the data — which is the property that shrinks the compliance boundary.

Field-level encryption keeps ciphertext in place. Systems still hold the data, protected. Scope shrinks less, because possession of ciphertext plus any key access is still possession.

The deciding question

Do downstream systems need the value, or only a consistent identifier for it? If they need to join, deduplicate and analyse without ever displaying the original, tokenisation removes them from scope entirely and is clearly better. If they must operate on the actual value, tokens force a detokenisation call and the vault becomes a hot dependency on a critical path.

The costs of tokenisation

• The vault is a single point of failure and a very attractive target. Availability and blast radius both concentrate there.
• Format-preserving tokens keep schemas working but leak format, and a token shaped like a phone number in a log is still a linkable identifier.
• Deterministic tokens allow joins and enable correlation across systems, which partially undoes the protection. Non-deterministic tokens are stronger and prevent the joins the business needs.
• Detokenisation access is the real control surface — a system with unrestricted detokenisation is in scope no matter what it stores.

The pattern that usually wins

Tokenise at ingestion, at the edge, so raw values never enter the general estate; detokenise only at the narrow points that genuinely need the value, with per-call authorisation and audit. And use crypto-shredding for erasure — destroying the per-subject key makes the data unrecoverable everywhere at once, including in backups, which is the only practical answer to deletion in an immutable estate.