April 2022 Summaries

Sendsecure.ly is a free web application created during a Basis Theory hackathon to help users share sensitive information, such as passwords, personal identification numbers, payment details, and API credentials, without leaving the original data permanently in email, SMS, or chat histories. Users enter a secret, select an expiration period of 10 minutes, one hour, or 24 hours, and receive a single-use link that reveals the information once before immediately invalidating the URL and purging the underlying data. The service transmits data with TLS 1.2 and relies on Basis Theory’s PCI Level 1 data vault and SOC 2-compliant environment to encrypt and tokenize the secret, while storing expiration metadata with the token. Although anyone who obtains the link can access the secret, the product reduces exposure through short configurable lifetimes and one-time retrieval. Built as a TypeScript and Next.js application using Basis Theory’s JavaScript SDK, the open-source project is available for personal and professional use, with its codebase and development resources shared through GitHub and Basis Theory documentation.

Basis Theory’s Ruby gem is presented as a way for Rails developers to tokenize sensitive information through a PCI Level 1-compliant vault without building and maintaining their own encryption or key-management infrastructure. After installing the gem and configuring a client with an API key, developers can create tokens for data, store token IDs in their databases, and retrieve underlying values when needed. The approach is intended for information such as government IDs, Social Security numbers, tax IDs, and confidential business materials, while reducing the operational and compliance burden associated with handling raw sensitive data. Proposed future capabilities include searching encrypted token data without decrypting it locally and integrating tokenization more directly with Rails ActiveRecord models through an EncryptableRecord-style provider or simple tokenization declarations.

Basis Theory argues that data security is fundamentally a developer-service and user-experience problem, because compliance, encryption, access controls, and auditing often compete with engineering priorities while remaining complex, decentralized, and prone to human error. Drawing on interviews with more than 100 developers and experience at Twilio, Klarna, and Dwolla, the company identifies recurring challenges in securing, using, and managing sensitive data, including uncertain early architectural decisions, the tension between protecting data and making it useful, inconsistent governance, and difficult audit processes. Its platform aims to abstract these burdens through PCI Level 1, SOC 2, and HIPAA-compliant environments, encrypted storage and static tokenization, managed encryption keys, searchable token attributes, secure code execution through Reactors, in-flight detokenization via Proxy, granular permissions, API-based automation, Terraform support, and centralized operational tools. After launching in beta, Basis Theory announced general availability and new investment while positioning its service as a way for developers to securely handle sensitive data with less compliance and operational overhead.

Reactors are a serverless compute service from Basis Theory designed to help developers process, analyze, and share sensitive data without exposing it to their existing applications or systems. They address the compliance, security, and access constraints associated with data such as payment card information, personally identifiable information, bank account details, and confidential business records, which can otherwise limit product functionality and require costly secure environments. Developers invoke Reactors through HTTPS requests to run Node.js-based Reactor Formulas against tokenized data inside an isolated Basis Theory Tenant, inheriting the platform’s PCI Level 1 and SOC 2 controls. Formulas can be pre-built Official Reactors for common integrations and operations or custom code, currently in beta, for tasks such as generating documents, transferring files through SFTP, analyzing sensitive data, and sharing controlled outputs with third parties.

Basis Theory Proxy enables applications to send sensitive tokenized data to third-party HTTP endpoints without exposing plaintext values within their own systems. Acting as a standard HTTP proxy, it receives requests, detokenizes token identifiers into their underlying values, forwards the completed request to a specified destination, and returns the destination’s response unchanged. It supports both individual values, such as Social Security and driver’s license numbers, and complex tokenized objects such as payment cards, while JSON Path-based transformations allow developers to extract, rearrange, or reformat token fields to meet external API requirements. Integrating the Proxy generally requires only replacing raw request values with token identifiers and adding destination and API-key headers, allowing existing HTTP workflows to remain largely unchanged while reducing sensitive-data exposure and supporting compliance efforts.

Basis Theory Tenants are free, flexible containers that logically and securely isolate token data, applications, reactors, and related configurations within a single organization. Organizations can create as many Tenants as needed to support separate development lifecycle environments such as development, QA, UAT, staging, and production, while maintaining distinct integrations and datasets. Tenants can also divide data among business units that require restricted access without creating separate Basis Theory organizations, or segment data by individual customers in platform-based businesses. By assigning customer-specific Application Keys within separate Tenants, companies can allow customers to use Basis Theory capabilities such as Reactors and Proxy while ensuring they cannot access other customers’ tokens or data.

Sensitive data breaches can cause financial and reputational harm, while conventional database encryption, encryption at rest, and access controls may still expose data to authorized applications or require complex encryption-key management. The described approach uses Basis Theory tokenization to replace sensitive values with tokens, allowing controlled sharing across applications through per-application permissions without distributing, rotating, or storing encryption keys. It demonstrates a low-code Entity Framework implementation that creates a generic value converter to tokenize data before database writes and detokenize it during reads, a custom attribute to mark sensitive model properties, and a provider wrapping the Basis Theory .NET SDK for token creation and retrieval. An extension method scans Entity Framework model properties for the attribute and applies the appropriate converter, enabling developers to protect fields such as email addresses by configuring a tokenization provider in the database context and adding the annotation to selected properties.