Let AI agents use sensitive data without exposing it.
TCrypt is a tokenization layer for agentic AI. It protects the PII, PHI, financial identifiers and proprietary fields you select inside your application boundary, before that context reaches an external model. Format and structure are preserved where configured, and every restoration sits behind identity-controlled threshold authorization.
Agents need your data. External models should not receive the cleartext.
The moment an agent queries a database, CRM or file system, sensitive fields ride along into the model's context window.
Context is broad and variable
Agents retrieve broad and variable context, and PII, PHI and financial identifiers ride along inside it. TCrypt gives deterministic control over which configured fields are protected, rather than guessing at what is sensitive.
Exposure can outlive the request
Once cleartext leaves the application boundary it may also appear in provider logging, application traces, memory systems, or other downstream records outside the original boundary.
Conventional redaction can reduce data utility
Strip a field out entirely and the workflows downstream of it lose the structure they validate against. Protection has to leave the data usable.
Prompt inspection is not the same as preventing model exposure.
Stripping the field protects it and breaks it.
Conventional scrubbing mangles the layout and destroys the structural cues a model needs to reason. The same patient record, handled three ways.
The model reasons. The PHI is exposed.
- PHI protected
- Structure intact
- Model can reason
The PHI is safe. So is the meaning.
- PHI protected
- Structure intact
- Model can reason
The PHI is safe. The record still works.
- PHI protected
- Structure intact
- Model can reason
A date that is still a date and an identifier that is still the right length let the model keep applying formatting rules and downstream validation keep passing. Illustrative record.
Three states. One controlled crossing.
Cleartext stays inside your boundary. Models work with structurally useful protected context. Restoration happens only inside a governed workflow, including the times it is refused.
A record crosses, and comes back under authority
Selectors decide what is protected. The model gets a structurally intact payload. Restoration is a governed request, not a function call.
Only the configured selectors are tokenized. account_id and claim_note are left alone, which is the point: what gets protected is what you configured, not what a classifier guessed at. Illustrative payload.
The same thing, without the notation
A claims record, an assistant that helps work the case, and a real name that never leaves your systems.
The stand-ins keep the same shape as the real values, so the systems that check the shape of a card number still pass. Illustrative record.
A pre-flight and post-flight loop for every agent.
TCrypt ships as a standard Model Context Protocol server: a native, discoverable tool for agent frameworks.
Agent pulls the raw payload
Records are retrieved from your systems before context assembly, while everything is still inside your boundary.
Fields protected locally
Selector rules are applied in WebAssembly using the public key only. Cleartext remains inside the application boundary during tokenization.
Model reasons over protected context
The model receives a structurally intact tokenized payload and works with it normally.
Quorum-controlled detokenization
A secured gateway enforces access control, and every authorized restoration is recorded.
Built like infrastructure, not a filter.
Four properties that separate a privacy substrate from string scrubbing.
Deterministic field selection
Target nested fields with explicit selectors. What gets protected is what you configured, not what a classifier guessed at.
Two masking strategies
Format-preserving encryption keeps the original length and punctuation. Fixed-width tokenization converts variable-length text into uniform content-addressed tokens, which suits database lookups and caching. Chosen per field.
No reconstructed master secret
Decryption authority is split across independent nodes. No single node or administrator possesses the complete decryption secret.
Tamper-evident access records
Every detokenization leaves a signed record. The question of who restored what, and under whose authority, has an answer that outlives the request.
Anywhere agents touch regulated or sensitive records.
Strong early fits include healthcare, insurance and financial services, where PHI and cardholder data are the fields most often selected. The boundary problem itself is universal.
Customer-service agents
Account and identifier fields are tokenized before they enter model context, so the agent can still resolve the case.
Financial and insurance workflows
Format-valid tokens keep downstream validation intact, so the systems that check the shape of a value still pass.
Operations and back-office agents
Protected reasoning across internal records, with restoration gated on identity rather than left to the agent.
Protect before. Prove after.
TCrypt is the preventive half of the Weilliptic platform. Receipts is the evidentiary half. Both run on WeilChain.
Preventive
TCrypt
Protect sensitive data before model execution. Tokenize the fields you select, present the protected context to the model, and restore through threshold authorization.
Evidentiary
Receipts
Prove what happened afterward. Prompts and tool calls are signed and anchored, so the record of an interaction is independently verifiable rather than self-reported.
Explore Receipts →Tokenization, selection and restoration, answered.
The questions security architects and AI platform teams ask first, answered without hedging.
What is PII tokenization?
PII tokenization replaces a sensitive value with a stand-in token that carries no meaning on its own, so systems downstream can keep working without holding the original. TCrypt applies it to the fields you select, inside your application boundary, before agent context reaches an external model. Where you configure format-preserving encryption, the token keeps the shape of the original value, so validation that checks the shape of a card number or an identifier still passes.
Does TCrypt automatically discover PII and PHI in my data?
No. TCrypt protects the fields you name with explicit selectors, using JSONPath, XPath or patterns. There is no classifier deciding what looks sensitive, which means coverage is something you configure and audit rather than something you infer. If a field is not selected, it is not protected.
Does the external model ever see the cleartext?
No, for the fields you selected. Cleartext remains inside the application boundary during tokenization, and only the protected payload crosses to the model. Fields you did not select cross unchanged, which is why selector configuration is the control that matters.
Can tokenized data still be used by downstream systems?
Yes, where you configure format-preserving protection. TCrypt offers two masking strategies per field: format-preserving encryption, which keeps the original shape and length, and fixed-width tokenization for cases where structure does not matter. This is what separates tokenization from redaction, which removes the value entirely and can reduce the data's usefulness.
Who can restore the original value?
Restoration requires a verified identity and approval from a threshold quorum. No single node or administrator possesses the complete decryption secret, so no one person can unilaterally reveal a protected value. Every authorized restoration leaves a tamper-evident access record, and refused requests are recorded as well.
Is there a master key that could be stolen?
No single master secret is ever reconstructed. Decryption authority is split across independent nodes and exercised through a threshold quorum, so compromising one node or one administrator does not yield the ability to restore protected values.
How is TCrypt different from redaction or a DLP tool?
Redaction removes data and DLP watches for it leaving networks and endpoints, while TCrypt protects selected fields inside the application as agent context is assembled. Security teams know this problem as data leakage prevention, but conventional DLP sits at the network and endpoint layer, and agent context is assembled inside the application before it gets there. TCrypt is not a DLP product and does not replace one.
Which agent frameworks does TCrypt work with?
TCrypt ships as a standard Model Context Protocol server, so it appears as a native, discoverable tool to any client that speaks MCP. That includes common agent frameworks and custom MCP clients, alongside direct integration where a framework is not in use.
Does TCrypt make my organization HIPAA or PCI compliant?
No product makes an organization compliant, and TCrypt does not claim to. It provides technical controls that support obligations around sensitive data handling, including selective field protection, governed restoration and tamper-evident access records. How those controls map to a given framework is a determination your compliance team makes.