I’ve been researching sensitive document workflows in healthcare, legal, and compliance-heavy environments.

One thing that keeps bothering me:

Most privacy/security products still require organizations to trust vendors with readable sensitive data.

Even many “privacy vault” systems persist:

* plaintext * token mappings * or both

So the trust boundary never really disappears.

I’ve been exploring whether there’s a viable model where:

* sensitive data inside documents is tokenized before sharing * vendors never persist readable plaintext * customer-controlled keys handle reveal flows * and the vendor literally cannot leak what it does not hold

The architecture itself seems feasible using:

* tokenization/FF1 * customer-held KMS keys * ephemeral processing * audit-only metadata retention

What I’m trying to understand is whether this materially changes:

* security reviews * compliance approvals * BAA/vendor trust conversations * operational workflows

Curious whether anyone here has:

* encountered this problem directly * seen vendors rejected over plaintext exposure concerns * worked on privacy-vault/tokenization systems * or believes “vendor cannot access plaintext” meaningfully changes the trust model

Still very early and mostly doing discovery conversations.