Definitions · T
Trust Vault
Trust Vault is Blekline's stateful tokenization layer: sensitive values are replaced with cryptographic placeholders before LLM context, then re-hydrated in-cluster on approved tool calls. Placeholders use the BLW_VAULT_* format.
Trust Vault dynamically tokenizes sensitive values (PII, API keys, secrets) before they enter LLM context, storing ciphertext in a session-scoped vault inside your VPC.
Flow
- Tokenize on ingress — plaintext →
BLW_VAULT_*placeholder - LLM reasons over placeholders only
- Hydrate on approved tool calls — placeholder → plaintext in-cluster
Shipped in NHIM sidecar (enterprise image). OSS sidecar returns NHIM_IMAGE_REQUIRED for vault routes.