Glossary

AI systems that take actions through tools and APIs rather than only producing text, for example calling a refund system or querying a database.

Operating without installing software on the protected host, typically by working at the network or protocol layer instead.

Sensitive data escaping the organisation through prompts, retrieval indexes, training sets, logs or vendor model providers.

Irreversibly transforming data so no individual can be identified by any reasonably likely means. Truly anonymized data falls outside most privacy regimes.

Access decisions driven by attributes of the user, the resource, the action and the context such as role, region and time, rather than by static role membership alone.

Designing so that a breach produces limited consequence, rather than assuming breaches can be prevented.

A model where the customer supplies and controls the encryption keys used by a service, typically through a cloud KMS or an on-premise HSM.

The contract required between a covered entity and any vendor that handles PHI on its behalf.

The primary account number, plus cardholder name, expiration date and service code when stored with it.

The people, processes and technology that store, process or transmit cardholder data or sensitive authentication data, plus connected systems.

California's privacy statutes, granting rights of access, deletion, correction and opt-out from sale or sharing of personal information.

An attack executed in the user's browser rather than on the server, so server-side controls and WAFs cannot see it.

A numeric indication of how certain the classification engine is that a value is what it has been labelled as.

The controller determines the purposes and means of processing; the processor acts on the controller's instructions.

Determining what a discovered value actually is and how sensitive it is, using pattern matching, validity checks, context, named-entity recognition and confidence scoring.

Locating where sensitive data exists across databases, file shares, object storage, SaaS applications, mainframes and unstructured content.

Scans databases, data lakes, SaaS apps and file systems to discover and classify sensitive data such as PII, PHI and PCI using data policy configuration.

Unauthorized transfer of data out of an environment, whether by an external attacker, an insider or a misconfigured integration.

Permanently obscuring a value while preserving format or showing partial information. Irreversible; there is no mapping and no way back to the original.

The contract governing a processor's handling of personal data on a controller's behalf, required under GDPR Article 28.

A requirement that data be physically stored within a defined geography.

DataStealth's category. A single platform covering discovery, classification, posture and protection (tokenization, masking, encryption) across the data lifecycle in on-prem, hybrid and cloud environments.

Industry term for continuous discovery, classification, visibility and monitoring of data risk. It tells you where sensitive data lives and who can reach it. It does not protect the data.

The principle that data is subject to the laws of the country in which it is located or whose entities can compel access to it.

The uncontrolled proliferation of data copies across systems, clouds and vendors, expanding the attack surface faster than governance can track it.

General-purpose tokenization for governance, risk and compliance use cases, applied to any type of sensitive data.

Removing or transforming identifiers so a record cannot reasonably be linked to an individual. Under HIPAA this has two defined methods: Safe Harbor and Expert Determination.

Tokenization where a given input always maps to the same token, enabling joins and matching on protected data.

Authorized reversal of tokenization, retrieving the original value from the vault for a legitimate business need such as processing a payment.

Real-time, irreversible obfuscation applied inline. Masks sensitive fields for users or applications lacking the right privileges without changing the underlying data.

Third-party JavaScript loaded on payment pages that ESP monitors for integrity. Unexpected changes can indicate a Magecart-style attack or unauthorized modification.

A numeric vector representation of text used for semantic search and retrieval. Embeddings can leak information about their source content.

Monitors and protects against client-side threats such as Magecart by detecting and blocking unauthorized scripts and security-impacting headers, maintaining the integrity of web payment forms.

The three phases of an eSkimming Protection deployment. Passthrough runs inline with minimal inspection to prove the integration. Detection, also called the soaking period, logs and alerts without blocking while the approved script inventory is built. Enforcing, also called blocking mode, actively blocks unauthorized scripts.

The HIPAA de-identification method where a qualified statistician certifies that re-identification risk is very small.

What an inline component does when it fails. Fail-open passes traffic through unprotected; fail-closed blocks traffic entirely.

A value incorrectly identified as sensitive. High false positive rates cause alert fatigue and erode trust in discovery output.

The revised NIST format-preserving encryption mode. The original FF3 was cryptanalytically broken and withdrawn; FF3-1 is the corrected version.

A token or protected value that keeps the same shape as the original, so downstream applications, validations and schemas continue to work unchanged.

Encryption that preserves the original format, length and character set of a value, so a sixteen-digit card number encrypts to another sixteen-digit number.

Injecting malicious code into a web form to capture submitted data before or as it reaches the legitimate destination.

The European data protection regulation governing processing of personal data, with extraterritorial reach and penalties up to four percent of global turnover.

A tamper-resistant physical device that generates, stores and uses cryptographic keys without exposing them to the host system.

An attack strategy of capturing encrypted data today in the expectation that future computing advances will make it decryptable.

US legislation governing the privacy and security of protected health information, comprising the Privacy Rule, the Security Rule and the Breach Notification Rule.

A stronger model where keys never leave the customer's control, even during cryptographic operations.

Protects embedded iFrames, including hosted payment fields and third-party widgets, from clickjacking, overlay hijacking and malicious script interference.

A managed service for creating, storing, rotating and controlling access to cryptographic keys. AWS KMS, Azure Key Vault and Google Cloud KMS are the major examples.

A model trained on large text corpora that generates and reasons over natural language, underpinning assistants such as ChatGPT and Copilot.

Quebec's private-sector privacy law, substantially reformed in 2021 with obligations phased in through 2024. Stricter than PIPEDA on consent, transparency and automated decision-making.

Granting each user, service and process only the access required for its function, and no more.

The highest PCI DSS service provider tier, requiring an annual on-site assessment by a QSA.

A category of client-side attack in which malicious JavaScript is injected into checkout pages to skim payment card data as customers type it.

A natural language processing technique that identifies entities such as names, locations and organisations inside free text.

The core runtime that orchestrates all DataStealth components: policy engine, workflow execution, module loading, configuration, and coordination between proxy modules, engines, storage and batch processors.

Hiding sensitive data while preserving its format or exposing partial information, such as displaying only the last four digits of a card.

Component that parses and protects sensitive data inside a specific payload format: JSON, XML, SOAP, CSV, spreadsheet, document, image and others.

Credit card and payment information subject to the PCI Data Security Standard.

Specialised discovery focused on identifying payment card data and payment-related information across systems.

Tokenization focused specifically on payment card data and PCI compliance use cases.

Secures payment forms through hosted or protected implementations, preventing compromise of cardholder data at the point of capture.

The security standard governing organisations that store, process or transmit payment card data. Current version is v4.0.1.

Requires a change and tamper detection mechanism to alert on unauthorized modification of payment page HTTP headers and content.

Requires management and integrity assurance of all scripts loaded and executed in the consumer's browser on payment pages.

An elected body of Participating Organizations that provides industry input into PCI standards. The 2025 to 2027 term comprises 64 organizations. DataStealth holds a seat.

Data that can identify an individual, including names, addresses, email addresses, phone numbers and government identifiers.

Ontario's Personal Health Information Protection Act, governing health information custodians and their agents.

Canada's federal private-sector privacy law, governing collection, use and disclosure of personal information in commercial activity.

Cryptographic algorithms designed to resist attack by quantum computers. NIST standardised the first set in 2024.

The payment card number itself. The element that determines PCI DSS scope wherever it is stored, processed or transmitted.

The senior tier of PCI SSC membership, giving strategic input into standards development. DataStealth became a PPO in January 2025.

The input sent to a model, which in enterprise use frequently contains customer records, account details and other regulated values.

Individually identifiable health information held or transmitted by a covered entity or business associate, protected under HIPAA.

Component that understands a specific wire protocol so DataStealth can inspect and transform data in motion: HTTP and HTTPS, SSH, SFTP, FTPS, SMTP, and database protocols.

Replacing identifying values with surrogates in a way that can be reversed with additional information held separately. Recognized in GDPR Recital 28 as a risk-reduction measure.

An individual or firm certified by the PCI SSC to assess compliance with PCI DSS.

Not vulnerable to attack by a quantum computer. For vaulted tokens this holds because there is no mathematical relationship to break.

A storage model requiring a minimum number of distributed nodes to respond before a protected value can be reassembled, so no single node compromise yields a usable record.

The likelihood that a protected record can be linked back to an individual, whether through weak substitution, retained partial values, or combination with other datasets.

Permanently removing or blacking out sensitive information, leaving no trace of the original. Includes replacing a value with NULL and area redaction in PDFs and images.

The property that the same input value always produces the same protected output everywhere it occurs, so joins, foreign keys and application logic keep working across tables.

An architecture where a model retrieves relevant documents from an index at query time and uses them to ground its answer.

The HIPAA de-identification method that requires removal of eighteen specified identifier types and no actual knowledge that the remainder could identify an individual.

Removing systems from the assessed environment by ensuring they no longer store, process or transmit cardholder data, typically by tokenizing before ingress.

Full track data, card verification codes and PINs. Must never be stored after authorization, even encrypted.

Copies of sensitive data in locations outside the sanctioned inventory: forgotten dev copies, exports, backups, orphaned shares.

Applications and services adopted by business units without IT or security approval.

A companion process deployed alongside an application, commonly in a service mesh, that intercepts its traffic.

An attestation report on controls relevant to security, availability, processing integrity, confidentiality and privacy.

Persistent, always-on access rights held by a user or service regardless of whether the access is currently needed.

Traditional approach that creates a separate, permanently masked copy of a dataset for non-production use.

De-identifies production data in real time during transfer to non-production environments, creating safe datasets for development, testing and analytics.

Decrypting a TLS session at an intermediate point so its contents can be inspected or modified, then re-encrypting onward.

Non-mathematical, keyless replacement of a sensitive value with a format-preserving surrogate. The mapping between token and original is held in a vault.

An inline component that intercepts and transforms traffic without requiring changes to the client or the application.

Data without a predefined schema: documents, PDFs, scans, images, logs, emails, free-text fields.

Secure, distributed storage for sensitive data and token-to-real-value mappings. Uses a cabinet-based architecture that can split tokens across multiple physical locations.

Tokenization where token-to-value mappings are stored in a secure vault. Provides true data separation because the token carries no derivable relationship to the original.

Tokenization performed by cryptographic transformation rather than a stored mapping. Requires no vault but depends on cryptographic keys. In practice this means format-preserving encryption.

A security model that assumes no implicit trust based on network location and verifies every access request against policy.