Tokenization

Typed: the category survives#

A Salus token carries its data class: [PHONE_8f3a1d], [IBAN_c21f8e], [NAME_77b04d]. The external model knows it is looking at a phone number, an account, a person — it just doesn't know which one. That is usually all the reasoning task needs: summarize the complaint, draft the reply, classify the ticket.

Deterministic: relationships are preserved#

Tokenization is deterministic within a Context — the boundary within which identity remains consistent. The same subscriber number produces the same token throughout the workload the Context represents: a conversation, a document, a batch job. This is what keeps AI quality high. If a customer appears five times in a support thread, the model sees the same token five times and can connect the references, exactly as it would with the real value.

The Context boundary is defined by the workload, and consistency is deliberately scoped to it: tokens are stable inside a Context and differ across unrelated ones — a privacy property, not a limitation.

Reversible: the vault closes the loop#

The token-to-value mapping is restoration state held entirely inside your environment: the current implementation holds it in an in-memory Context Store behind a replaceable storage interface, and persistent deployments place that interface over hardened, customer-controlled storage and key custody — see Vault. When the provider's answer comes back containing tokens, the engine looks them up and restores the original values before the answer reaches the user.

The vault is deliberately the most sensitive asset in the system, which is why it lives on your infrastructure, under your keys, with no vendor access path.

What tokenization costs the model#

Honesty matters here: the model loses the value itself. Operations that need the real characters degrade — arithmetic on a tokenized amount, validating an IBAN's checksum, spell-checking a name. Three things bound this limit in practice:

1. Policy decides what is tokenized. Identity classes (names, national IDs, phone numbers, account numbers) always mask. Numeric and quasi-identifying classes (amounts, dates) are configurable — many deployments pass amounts in the clear once identities are masked.
2. Agent workloads compute inside anyway. In agentic flows the model orchestrates while tools execute — and tool execution runs inside your perimeter on restored values. Only the reasoning trace crosses the boundary, tokenized.
3. What remains is documented, not hidden. Model-side arithmetic or format validation on a tokenized value does not work, and Salus says so.