Tokenisation
Replacing a sensitive value with a non-sensitive surrogate, with the mapping held in one tightly-controlled vault.
The card number is stored once, in a vault; every other system holds a token that is useless if disclosed. Systems that need to charge the card call the vault; systems that only need to identify the card — for a receipt, a report, a rebill — never see the real value.
The commercial argument is scope reduction. Under PCI DSS, systems that never handle cardholder data fall out of assessment scope, so tokenising at the edge can remove dozens of systems from an expensive annual audit. The same logic applies to personal data and to any regulated field.
Distinguish it from encryption: encrypted data is still the data, mathematically recoverable with the key, and it travels wherever the ciphertext travels. A token has no mathematical relationship to the original at all — recovery requires the vault, which is a single auditable choke point.
Design considerations: the vault is now critical infrastructure needing its own availability and recovery design; format-preserving tokens avoid changing every downstream schema; and deterministic tokens (same input, same token) enable joins and deduplication at the cost of leaking equality.