Replacing sensitive data (typically PAN) with a non-sensitive surrogate value (token).
Tokenisation replaces sensitive data — most commonly the Primary Account Number (PAN) under PCI DSS — with a non-sensitive surrogate token that has no exploitable value if breached. Detokenisation requires access to the secure token vault.
Run a free ComplianceIQ audit against PCI DSS and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.