Detector · contact

Email addresses tokenization

Email addresses are the single most common PII type leaked to LLM providers — they show up in support tickets, sales call transcripts, contract drafts, and prompt injections. Cypherz detects every RFC-5322-compliant email in a payload, swaps it for a deterministic surrogate, and restores the original on the way back.

  • 01

    Deterministic tokens

    The same email address always maps to the same surrogate within a project. Aggregations, joins, and dedupe keep working.

  • 02

    Encrypted vault

    Mappings are stored encrypted under a per-project AES-256-GCM key.

  • 03

    Multi-language safe

    Punycode and internationalized email addresses are handled correctly.

Same input, with and without Cypherz

// Without Cypherz — the model sees real data:
Send to john.doe@acme.com and cc legal@firm.io.

// With Cypherz — the model sees surrogates:
Send to <EMAIL_a1b2c3d4e5f6> and cc <EMAIL_d4e5f6a1b2c3>.

// The application gets the original back inside its trust boundary.

Common questions

Frequently asked.

Are email addresses tokens deterministic?

Yes — within a project, the same input always maps to the same surrogate token. This makes joins, dedupe, and analytics keep working on tokenized data without ever decrypting.

Can I disable this detector for a specific project?

Yes — every detector is toggleable per project at creation time and editable from the dashboard.

What if I have a custom format Cypherz doesn't recognize?

Add a custom regex or literal list per project. Cypherz applies your rules after the built-in detectors run.

Are tokenization mappings encrypted at rest?

Yes — AES-256-GCM with envelope encryption. Each project has its own data-encryption key wrapped under the master key.

Get started

Add email addresses protection to your AI features.

Sign up, create a project, copy your API key. The first request is tokenized in under sixty seconds.