Stop storing plaintext names, emails, phone numbers, and civic addresses inside web apps that face the public internet. 3wVault intercepts, seals, and isolates every identity inside an authenticated AES-256-GCM bunker—returning only an unexploitable token (`3wv_usr_...`) to your database.
Modify the fields below or trigger a simulated SQL dump to observe how your database reacts under attack.
Attacker dumped `SELECT * FROM orders JOIN users`. Result: 0 names, 0 emails, 0 phone numbers exposed. Autonomous Circuit-Breaker locked the compromised web server API key in 180ms.
Engineered by TonCodeur.com / 3wLabz to eliminate toxic PII liability across e-commerce, municipal logistics, SaaS platforms, and clinical portals.
Route scheduling and recurring invoicing run entirely on opaque `3wv_usr_` tokens. Field tablets and dispatch tables never store raw homeowner identities.
User profiles, telemetry, and transactional notifications operate via Zero-Knowledge Blind Email without exposing personal email addresses to application logs.
Recognizes returning buyers across seasonal fundraising campaigns using deterministic Blind Indexes while keeping shipping and contact data sealed off-server.
Separates sensitive intake records from clinical scheduling databases, enabling instant cryptographic right-to-be-forgotten compliance.
Traditional encryption-at-rest fails the moment an attacker compromises your web application or steals an active database connection. 3wVault moves PII out of your infrastructure entirely.
Every identity record is serialized and encrypted at the application layer before touching disk using AES-256-GCM. A fresh 96-bit cryptographically secure random IV (`random_bytes(12)`) and a 128-bit authentication tag verify mathematical integrity on every read—making tampering or bit-flipping attacks impossible.
sealed = AES256_GCM(key, iv_96bit, payload, aad_tenant_id)How do you find an existing customer by email or phone when the database is fully encrypted? 3wVault computes a salted, peppered `HMAC-SHA256` Blind Index of normalized identifiers. You can deduplicate and unify the same customer across multiple brands or portals in O(1) time without ever decrypting the table.
blind_idx = hash_hmac("sha256", canonical_email, VAULT_PEPPER)3wVault purposefully omits any bulk-list or dump API endpoint. Identities can only be resolved individually by token. If a compromised web server attempts to resolve more than your configured threshold (e.g., 40 tokens/min), the autonomous Circuit-Breaker trips, revokes the tenant API key in under a second, and alerts your security team.
if (rate_window_60s > tenant.max_rpm) { revokeTenantKey(); alertSOC(); }Your e-commerce or SaaS app never needs to know a user’s email address to send an invoice or password reset: pass `3wv_usr_...` and your template variables to `/v1/notify`, and the bunker dispatches the email internally. When a customer invokes Law 25 or GDPR Article 17, one API call cryptographically shreds their identity forever.
$vault->sendBlindEmail("3wv_usr_9f4a...", "invoice_paid", ["total" => "$149.00"]);Compare the legal, financial, and operational aftermath of a database compromise under a standard architecture versus a 3wVault Zero-PII architecture.
PII stored directly inside WordPress, Laravel, Symfony, or Node SQL tables
| id | full_name | phone | civic_address | |
|---|---|---|---|---|
| 41 | Alexandre Tremblay | [email protected] | +15148924410 | 1250 René-Lévesque O, MTL |
| 42 | Sophie Lavoie | [email protected] | +14189901122 | 400 Boul Charest E, QC |
Application DB holds only opaque `3wv_usr_...` tokens; PII sealed in isolated bunker
| id | vault_token (OPAQUE) | role | consent_loi25 | pii_columns |
|---|---|---|---|---|
| 41 | 3wv_usr_8f92a1c4e7b09d31a6f2 | patient | 1 | 0 BYTES (NONE) |
| 42 | 3wv_usr_2c41b8e9d0a57f12c3e8 | client | 1 | 0 BYTES (NONE) |
Send the incoming form or checkout PII to `POST /v1/tokenize` over TLS 1.3.
Save the returned opaque token in your local SQL database. Discard the raw PII from memory.
Trigger transactional emails directly via token or resolve a single record when strictly authorized.
<?php
require_once __DIR__ . '/sdk/3wVaultClient.php';
$vault = new ThreeWVaultClient(
apiKey: $_ENV['VAULT_TENANT_KEY'],
endpoint: 'https://api.3wvault.com/v1'
);
// 1. Seal customer PII inside the isolated bunker
$tokenResponse = $vault->tokenize([
'full_name' => $_POST['name'],
'email' => $_POST['email'],
'phone' => $_POST['phone'],
'address' => $_POST['address'],
'context' => 'order_checkout'
]);
$vaultToken = $tokenResponse['token']; // e.g. "3wv_usr_8f92a1c4e7b09d31"
// 2. Store ONLY the opaque token in your local MySQL database
$stmt = $pdo->prepare('INSERT INTO orders (vault_token, total_cents, status) VALUES (?, ?, ?)');
$stmt->execute([$vaultToken, 14900, 'paid']);
// 3. Send confirmation email without your server ever holding the email address
$vault->sendBlindEmail($vaultToken, 'order_confirmation', [
'order_id' => $pdo->lastInsertId(),
'amount' => '$149.00 CAD'
]);// Tokenize customer identity before writing to PostgreSQL / Prisma
const response = await fetch('https://api.3wvault.com/v1/tokenize', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.VAULT_TENANT_KEY}`,
'Content-Type': 'application/json',
'X-Vault-Tenant': 'memorix-prod'
},
body: JSON.stringify({
full_name: input.fullName,
email: input.email,
phone: input.phone,
address: input.civicAddress
})
});
const { token, blind_index } = await response.json();
// token => "3wv_usr_7c2e91a0b4f83d12"
await prisma.user.upsert({
where: { blindIndex: blind_index },
update: { lastLoginAt: new Date() },
create: { vaultToken: token, blindIndex: blind_index, plan: 'pro' }
});import os, httpx
VAULT_URL = "https://api.3wvault.com/v1"
HEADERS = {"Authorization": f"Bearer {os.environ['VAULT_TENANT_KEY']}"}
async def register_patient_intake(payload: dict) -> str:
async with httpx.AsyncClient(timeout=5.0) as client:
# 1. Seal PII inside 3wVault AES-256-GCM Bunker
res = await client.post(f"{VAULT_URL}/tokenize", json={
"full_name": payload["name"],
"email": payload["email"],
"phone": payload["phone"],
"address": payload["address"],
}, headers=HEADERS)
res.raise_for_status()
vault_token = res.json()["token"] # "3wv_usr_6a19f0c2..."
# 2. Law 25 Right-to-Erasure in one call when requested:
# await client.delete(f"{VAULT_URL}/token/{vault_token}", headers=HEADERS)
return vault_token# 1. Tokenize PII payload -> Returns opaque token + HMAC-SHA256 blind index
curl -X POST https://api.3wvault.com/v1/tokenize \
-H "Authorization: Bearer 3wv_live_sk_98a7bc65d4e3f2a1..." \
-H "Content-Type: application/json" \
-d '{
"full_name": "Alexandre Tremblay",
"email": "[email protected]",
"phone": "+15148924410",
"address": "1250 Rene-Levesque Blvd W, Montreal, QC"
}'
# Response (11ms):
# {
# "status": "sealed",
# "token": "3wv_usr_8f92a1c4e7b09d31a6f2",
# "blind_index": "b94f6e12a8c307d5e19f4a28c6b0d3e7f1a9c5b2d8e4f0a6c2e8b4d0f6a2c8e4",
# "cipher": "AES-256-GCM",
# "jurisdiction": "CA-QC"
# }Deploy a dedicated cryptographic tenant isolated behind Cloudflare WAF and Canadian sovereign storage. Automated billing via Stripe.
For corporate websites, quote forms, and professional service portals eliminating PII from their CMS.
For transactional e-commerce, SaaS apps, and medical/professional clinics requiring Zero-Knowledge notifications.
For multi-brand holding groups, franchises, and high-volume platforms unifying identities across domains.
Direct answers on latency, WordPress/Laravel compromises, blind search, and Canadian key sovereignty.
Your B2B identity has been tokenized into `owner_token` and your API credentials are ready below.