Definitions · T · Runtime enforcement
Trust Vault
Trust Vault is Blekline's stateful tokenization layer: sensitive values are replaced with cryptographic placeholders before LLM context, then re-hydrated in-cluster on approved tool calls. Placeholders use the BLW_VAULT_* format.
Trust Vault dynamically tokenizes sensitive values (PII, API keys, secrets) before they enter LLM context, storing ciphertext in a session-scoped vault inside your VPC.
Flow
- Tokenize on ingress — plaintext →
BLW_VAULT_*placeholder - LLM reasons over placeholders only
- Hydrate on approved tool calls — placeholder → plaintext in-cluster
Deployment
- Enterprise sidecar — full tokenize/hydrate in NHIM image
- OSS sidecar — vault routes return
NHIM_IMAGE_REQUIRED - Cloud preview —
/vaultin-app shows retention policy and archive metadata (eval workspaces)
In Blekline
- In-app: /vault · Docs: Trust Vault sidecar
- Pairs with Zero Standing Privilege for AI