Protect sensitive values while preserving the format applications expect. Ubiq pairs format-preserving encryption with identity-governed runtime controls, so teams can decide when data is revealed, masked, de-identified, or otherwise protected based on who or what is accessing it.
Trusted in production by security & data teams
Independently attested
SOC 2 Type II
PCI DSS SAQ-D
CMMC 2.0 Level 1Format-preserving encryption (FPE) is a method of encrypting data so the protected value keeps the same format, length, and character set as the original. A 16-digit card number stays a 16-digit value and a national ID keeps its structure, so encrypted data fits existing database schemas, applications, and validation rules without changes.
Encrypted values keep the original data type, length, and character set, so they drop into existing fields, schemas, and APIs without migrations.
Deterministic encryption maps the same input to the same protected value, so joins, lookups, and analytics keep working across systems.
Authorized identities can recover the original value, while every other identity only ever sees the protected form.
FPE preserves the length, character set, and structure of sensitive values. Standard AES changes the output format, which can create friction for existing applications and databases.
No longer fits the original card number format
Breaks the expected ID pattern
May require validation, schema, or app changes
FPE helps protected data continue to fit existing fields, applications, databases, and workflows with fewer changes.
Format-preserving encryption protects the value and keeps it usable, but it does not control who can read that value in cleartext at runtime. Whether it comes from a legacy data protection platform or a built-in integration, encryption on its own still leaves overprivileged access, insider risk, and inconsistent controls unaddressed across applications, databases, APIs, analytics, and AI workflows.
Format-preserving encryption keeps a value usable, but it does not decide which identities can turn it back into cleartext at the moment of access.
Once a system or service can decrypt, every identity behind it can read plaintext, regardless of role or context.
Applied per application or database, encryption policies become inconsistent across the many paths that touch sensitive data.
Encryption alone gives no visibility into which identities and workflows are actually reading protected values.
Ubiq keeps format-preserving encryption and adds identity-governed control over who can read protected values at runtime.
How Ubiq works
Format-preserving encryption protects the value. Ubiq evaluates the requesting identity, context, and policy at runtime, then returns only the representation that identity is authorized to see.
Access request
Protected employee record
Real-time evaluation
Runtime data outcome
Authorized to process the full employee record
Needs to confirm the record, not read all fields
Authorized for analysis without exposing original identifiers
Receives only the fields and detail needed for its task
Protected once. Resolved differently at runtime for each identity.
Format-preserving encryption protects sensitive fields without breaking the systems that depend on their shape. These are the workflows where it matters most.
Protect PANs and payment data while keeping the 16-digit format that payment systems, gateways, and validators expect.
Encrypt names, emails, and national IDs so analysts and BI tools can join and segment on protected values without exposing cleartext.
Keep regulated data protected as it moves between regions and teams, with cleartext access decided by identity and policy.
Feed format-preserving protected values into training and inference so models work without sensitive data in the clear.
Protect fixed-format fields in older systems without rewriting schemas or breaking downstream integrations.
Share realistic, format-correct data with vendors and lower environments while the real values stay protected.
Ubiq deploys inside your own environment and integrates where sensitive data already lives, so teams adopt it without heavy operational friction.
Add protection with a few lines of code across major languages, live in minutes.
Protect and reveal values through SQL UDFs and native database and data warehouse integrations.
Integrate at applications, services, and API gateways without rearchitecting them.
Reuse your existing IAM so runtime decisions follow the identities you already manage.
Bring your own HSM or KMS so key control stays with your team.
Deploy with no proxies in the data path and no database schema changes where applicable.
Format-preserving encryption is a method of encrypting data so the protected value keeps the same format, length, and character set as the original. A credit card number stays a 16-digit value and a national ID keeps its structure, so encrypted data fits existing schemas, applications, and validation rules without changes.
Format-preserving encryption uses a cryptographic key to transform a value into a same-format ciphertext that can be reversed with the key. Tokenization replaces a value with a substitute token, which can be vaultless or vault-based. Ubiq supports both, and in either case governs at runtime which identities can recover the original value.
Fixed-format fields where the shape matters: payment card numbers, account numbers, national IDs, phone numbers, and customer identifiers. Format-preserving encryption protects these values while keeping them compatible with systems and validation that expect the original format.
On its own, no. Format-preserving encryption protects the value, but it does not decide which identities can read it in cleartext. Ubiq adds that layer: it evaluates identity, context, and policy at runtime and returns full cleartext, masked, de-identified, or no data.
Ubiq protects values once with format-preserving encryption, then evaluates the requesting identity, context, and policy at runtime and returns the authorized outcome. The same protected value resolves to different outcomes for different identities across applications, databases, BI tools, and AI workflows.
Yes. Ubiq integrates through SDKs and APIs, SQL UDFs, and database and data warehouse integrations, so format-preserving protection and identity-governed access apply consistently across applications, APIs, databases, warehouses, BI tools, and AI workflows.