August 2022 Summaries

Data remediation is the process of making organizational data complete, accurate, secure, and fit for business and regulatory needs, with particular emphasis here on protecting sensitive information from unauthorized access or breaches. Organizations should establish or revise remediation policies in response to regulatory updates, major business changes such as acquisitions, or security incidents, involving data owners, technical users, security teams, legal staff, and management. Effective planning begins with data discovery and classification according to sensitivity, legal requirements, and the consequences of disclosure, allowing access controls to be applied proportionately. Key security approaches include encryption, which strongly protects data but creates challenges around keys, data in use, and system compatibility; tokenization, which substitutes sensitive values with tokens and can reduce compliance scope while introducing third-party and master-data protection considerations; and deletion, which eliminates exposure risk and supports retention rules but permanently removes data value. Masking, anonymization, and deidentification are related techniques, while a practical strategy often combines tokenization for operational use, encryption for stored source data, and deletion at the end of the data lifecycle, balancing security, compliance, usability, and implementation burden.

Data encryption protects sensitive business and customer information by converting plaintext into ciphertext through an algorithm and key, while decryption restores the original data using the appropriate key. It distinguishes symmetric encryption, which uses one shared key and is efficient for bulk data, from asymmetric encryption, which uses public and private key pairs and is commonly used to establish secure shared keys. The discussion covers modern and outdated algorithms, including AES, RSA with sufficiently long keys, 3DES, and post-quantum CRYSTALS-Kyber, and explains encryption’s roles for data at rest, in transit through HTTPS/TLS, and, less practically, in use through homomorphic encryption. Although encryption is relatively accessible, supports regulatory compliance, and can be applied across systems, it requires careful decisions about implementation, secure key storage, key rotation, data sharing, and protection of decrypted information. Tokenization is presented as an alternative for handling sensitive values by replacing them with nonreversible references managed in a secure vault, while hashing is differentiated as a one-way process primarily used to verify integrity or passwords, often strengthened with salts to resist lookup-table attacks.

Basis Theory reports strong demand following its late-April general availability launch, citing extensive interest from companies across sizes and regions, the hiring of President Casey Clegg, expansion into India for APAC support, and onboarding of customers including three unicorns and a public company. The company attributes this momentum to tokenization becoming a more mainstream way for organizations to secure and use sensitive data while outsourcing non-core compliance infrastructure, particularly as IT budgets continue to prioritize such platforms. It also emphasizes a developer-first strategy, arguing that API-first tools, infrastructure-as-code management, clear documentation, and flexible token design can improve both developer adoption and security practices. Growing data-residency and privacy requirements worldwide, including existing and proposed laws in Europe, India, Kenya, and several U.S. states, are presented as a major driver of demand, as companies face increasing complexity and cost in managing regulated data themselves. Basis Theory positions its platform as a way to help businesses retain control and usability of sensitive data while delegating security and compliance burdens to a specialized provider.

Basis Theory introduced an `expires_at` property that automatically purges data at a specified date and time, supporting PCI requirements and internal data-retention policies. It also enhanced the configurable card and bank Token Type templates, allowing developers to use expressions to customize fingerprints, search indexes, masks, and aliases, including changing card masking behavior to expose a card’s Bank Identification Number when needed. Additional updates include stronger alias validation and support for the `id` variable in alias expressions, Safari Element communication fixes, improved Token ID copying behavior, a revised login interface, clearer Token documentation, autocomplete-friendly Elements, improved web portal color contrast, and mobile experience refinements.

Basis Theory’s configurable tokenization platform is designed to let developers adapt tokens to application-specific requirements rather than rely solely on fixed token types. Using Liquid-based Expressions, developers can create aliases that preserve database-compatible formats, customize masking to reveal only necessary portions of sensitive values, and define privacy controls based on data classification, impact level, and access restrictions. Tokens can also include non-sensitive metadata for organization and regulatory tagging, searchable indexes that enable querying without detokenization, and configurable fingerprints for secure uniqueness checks and deduplication. Time-to-live expiration settings support retention policies and temporary data use by automatically purging tokens at a specified date. These capabilities are available through Basis Theory’s public API and are intended to support flexible, secure handling of sensitive data while maintaining controls such as PCI Level 1 and SOC 2 compliance.