Control what each identity sees: Return cleartext only to identities that need it, and protected values to everyone else.
Mask, tokenize, or encrypt sensitive data based on identity
Protect sensitive data across applications, APIs, databases, data warehouses, analytics, and AI. Return cleartext, masked, tokenized, or encrypted data based on who or what is requesting it.
Request a DemoAccess request
HR app
Support analyst
Analytics API
AI agent
Protected employee record
- Employee ID
- EMP-3X9Q-1182
- Name
- Maria Chen
- maria@acme.com
- Salary
- $142,800
Real-time evaluation
Ubiq
Identity
Context
Policy
Runtime data outcome
HR app
CleartextAuthorized to process the full employee record
EMP-3X9Q-1182Maria Chenmaria@acme.com$142,800
Support analyst
MaskedNeeds to confirm the record, not read all fields
EMP-••••-1182Maria Chenm••••@acme.com$•••,•••
Analytics API
TokenizedAuthorized for analysis without exposing original identifiers
EMP-7K2M-4830Qenva Xltpx7kq2m9p@t4v8x.com$142,800
AI agent
MaskedReceives only the fields and detail needed for its task
EMP-••••-1182M•••• C•••m••••@acme.com$•••,•••
Same sensitive data. Different identities. Different outcomes.
Why use Ubiq Runtime Data Protection
Key Benefits
Reduce unnecessary cleartext exposure: Return masked, tokenized, format-preserving protected, or encrypted data when an identity does not need cleartext.
Protect data consistently: Apply masking, tokenization, and encryption consistently across applications, APIs, databases, data warehouses, analytics, and AI.
Two ways to protect sensitive data
Protect sensitive data before it is stored, when it is accessed, or both.
Protect before storage
The database stores protected data
Name
SSN
Secret passphrase
Maria Chen
9@8-%4-57!6
A7K9-Q2M4-X8P1
David Garcia
6#1-3$-24^5
M5R2-T9L8-B3C7
Natalie Brooks
2*4-6!-95&1
X4N7-P1D6-K9V2
Jason Wells
7?5-1+-46=9
Q8W3-Z6H1-R4M9
Melissa Moore
1/6-5_-80~4
L2C8-Y5T1-N7F4
Protect on access
The database stores cleartext data
Name
SSN
Secret passphrase
Maria Chen
415-82-1182
blue-ocean-harbor
David Garcia
312-74-6034
maple-river-stone
Natalie Brooks
646-57-8246
silver-forest-light
Jason Wells
202-24-1907
ember-cloud-garden
Melissa Moore
718-63-4189
autumn-lake-moon
How it works
Encrypt or tokenize selected sensitive fields before they are written to the database. Only protected values are stored.
When data is read, use identity and policy to return cleartext, masked, tokenized, or encrypted values.
Store the existing data without changing it.
When data is read, use identity and policy to return cleartext, masked, tokenized, or encrypted values.
Security impact
Protect before storage
Protects the underlying data
If database credentials are stolen, an administrator accesses the tables directly, or a backup or export is exposed, the original protected values are not revealed.
Protect on access
The underlying data remains in cleartext
Anyone who accesses the database directly, including a compromised administrator account or malicious insider, may still see the original sensitive data.
Operational impact
Protect before storage
Because protected values are stored in the database, stored procedures, searches, joins, reports, analytics, and downstream systems may need to be updated.
Protect on access
The stored data does not need to change. Existing stored procedures, searches, joins, reports, analytics, and downstream systems can continue operating on the original values.
Supported integrations
Protect before storage
ApplicationsDatabasesData warehousesAPI gateways
Protect on access
ApplicationsAPIsDatabasesData warehousesAnalytics / BIAI workflows
Protect the same data differently for each identity
Use the identity making the request and the policy for the data to return cleartext or a protected value. Apply dynamic data masking, vaultless tokenization, field-level encryption, application-level encryption, or format-preserving encryption through supported integrations.
Key Features
Protect data based on identity: Return the appropriate version of sensitive data based on the user, application, service account, API client, workload, or AI agent making the request.
Mask, tokenize, or encrypt: Apply dynamic masking, tokenization, format-preserving encryption, and field-level encryption to sensitive data.
Protect data where it is stored or accessed: Protect data before storage or when it is accessed through applications, APIs, databases, data warehouses, analytics, and AI workflows.
Advanced Feature
Protect sensitive data used by AI and RAG workflows.
Protect the complete vector record: Create the normal embedding first, then transform the stored vector and protect associated source content and metadata before storage.
Keep data protected: Stored vectors and associated data remain protected inside the customer’s environment.
Preserve search effectiveness: Vector similarity search continues to work in the protected space.
Apply policy before return: Ubiq uses identity and dataset policy to control the representation returned to the requesting AI system.
Protected vector data for RAG
Source content and embeddings remain protected
Sensitive source content
JPG
Images
DOC
Documents
MP4
Video
MP3
Audio
Protected embeddings
v1v2v3v4match
0.24−1.70.882.3
0.410.52−0.16−1.7
4.10−1.90.32−1.5
−1.10.732.125.3
3.502.3−0.440.5
AI querySimilarity searchAuthorized context is returned to the model
Similarity search works on protected data
Policy controls what the model receives
How it works
Answers
Runtime data protection questions
How Ubiq masks, tokenizes, encrypts, or reveals sensitive data based on identity and policy.
What is runtime data protection?
Runtime Data Protection controls whether sensitive data is returned as cleartext, masked, tokenized, format-preserving encrypted, or encrypted when it is requested. Ubiq uses the requester’s identity and the policy for the data to determine the result.
How does Ubiq decide what data a requester receives?
The customer’s identity system establishes who or what is making the request. Ubiq uses that identity and the policy for the data to determine whether to return cleartext, masked, tokenized, or encrypted data.
Which protection methods does Ubiq support at runtime?
Ubiq can return authorized cleartext, dynamically masked data, tokenized data, format-preserving protected data, or encrypted data based on identity and policy.
Can Runtime Data Protection be used independently?
Yes. Runtime Data Protection can be adopted independently for identity-based masking, tokenization, and encryption through supported integrations. Sensitive Data Discovery and Access Intelligence are not prerequisites. Adding those products connects sensitive-data findings and effective-access analysis to the same protection model.
Can Ubiq protect data before storage and on access?
Yes. Ubiq can encrypt or tokenize selected data before it is stored, or apply masking, tokenization, format-preserving protection, or encryption when cleartext data is accessed through a supported integration.
Can Ubiq control what sensitive data AI agents receive?
Yes. AI agents can act as requesting identities. Ubiq applies the policy defined for the requested dataset or field and returns the permitted value, such as masked, tokenized, format-preserving protected, encrypted, or authorized cleartext data.
Explore the Ubiq platform
Platform
Platform Overview
See how Sensitive Data Discovery & Classification, Access Intelligence, and Runtime Data Protection work together in one identity-driven platform.
Learn more
Product
Sensitive Data Discovery & Classification
Inventory supported sources, discover and classify sensitive data, record each finding’s location, and track changes over time.
Learn more
Product
Access Intelligence
Resolve effective permissions across human and non-human identities, groups, roles, policies, permissions, resources, and data.
Learn moreTokenize, mask, and encryptsensitive data based on identity.
See how Ubiq applies identity-driven protection across applications, APIs, databases, warehouses, analytics, streaming, and AI workflows.
Request a Demo