Concepts

A short glossary that covers the rest of the documentation.

Term	Meaning
Target	Top-level container scoping a project or application.
Configuration	Ruleset within a target.
Data instance	(class, property) pair, typically modelling a database column.
Transformer	Single operation: encrypt, tokenize, mask, validate, format, and so on.
Transformer sequence	Ordered chain of transformers applied to a data instance.
Rights context	Who is allowed to do this. Granular access control per data instance.
Processing context	Which operation should run. Typically Protect, Unprotect, or Search.
Logging context	What information to include in audit logs.
Dependency context	Helper values some transformers need to run.
Evidence	Key-value pairs sent with every request that route it to the right context.
Secrets manager	Where encryption keys are stored. Azure Key Vault or CipherTrust Manager.

The first three (target, configuration, data instance) are configured once. Rights and processing contexts are referenced by GUID on every API call. Evidence is supplied at request time.

Targets and configurations

A target is a container for one or more transformation configurations, usually one per project or application. A configuration is the set of rules inside a target that defines how data should be transformed.

Data instances

Data instances represent the specific fields you want to protect. Each instance is a (class, property) pair:

• Class name: the entity type, for example User, Payment, or Account.
• Property name: the attribute to transform, for example FirstName, Amount, or IBAN.

Instance	Example values
(User, FirstName)	Laura, John, …
(Payment, Amount)	12'450 CHF, 230 EUR, …
(Account, IBAN)	CH93 0076 2011 6238 5295 7

Typically a class maps to a table in a database and a property maps to a column.

Transformers and transformer sequences

Transformers are individual operations that modify data:

• Insert / Extract: inject or extract properties.
• Wrap / Unwrap: add or remove tags or keywords around a value.
• Validate: ensure a value meets criteria, using a regular expression.
• Format: replace a value, or part of it, with a pattern or placeholder.
• Transform: the reversible and irreversible operations:
  • Anonymization (irreversible).
  • Encryption / Decryption (reversible with a key).
  • Tokenization / Detokenization (reversible with a mapping table).

Transformers can be filtered by data type, so a sequence only applies to values of the right shape: date and time, email, IBAN, natural number, SSN, string, and UUID.

A transformer sequence is an ordered chain of transformers. Combining several transformers in a sequence builds a complete protect or unprotect workflow (for example, decrypt then mask).

Contexts

Contexts decide what happens on a given request. There are four kinds:

• Rights context: defines who can access which data instances and with what permission (Transform, Read, or Not defined), selected by an evidence set.
• Processing context: maps data instances to transformer sequences for a specific operation such as Protect, Unprotect, or Search, selected by an evidence set.
• Logging context: specifies what information to include in audit logs.
• Dependency context: provides helper values that some transformations need.

Rights and processing contexts are the two you reference by GUID on every API call.

Evidence

Evidence is a key-value pair that selects which rights context and which processing context apply to a request. It is the routing mechanism that connects an incoming request to the correct permissions and transformation rules.

When you configure a rights or processing context, you associate it with one or more evidence sets, i.e., combinations of key-value pairs that identify when the context applies. At request time, the evidence you send is matched against those sets to determine:

1. which rights context applies, controlling whether each data instance is transformed, returned as-is, or nullified; and
2. which processing context applies, controlling which transformer sequence runs on each data instance.

Evidence keys are fully customizable. Role and Action are common choices, but you can define any keys that fit your access-control model, such as Department, Region, or Environment.

How they fit together

A request carries evidence, attached to a rights context (who is calling) and a processing context (what to do). The request also carries the instances to transform, each pointing at a configured (class, property).

The engine looks up the configuration, validates that the rights context's evidence grants access to each data instance, runs the transformer sequence selected by the processing context's evidence, and returns one result per instance.

The same endpoint serves protect, unprotect, search, and any other operation your configuration defines. Only the evidence changes between calls.