databunker.
Docs ↗Book a demo
Home/How It Works
HOW IT WORKS

See where
the data goes.

Databunker Pro is a dedicated service beside your application. Sensitive profiles and files live behind its API. Your existing database keeps the references.

LIVE ARCHITECTURE WALKTHROUGH
ILLUSTRATIVE EXAMPLE
Original data
Stored encrypted in vault backends
Record reference
Identifies a profile; grants no access
API credential
Authorizes your backend’s requests
  1. 01
    Your app → DatabunkerProfile + file + API credential
  2. 02
    Databunker → Vault databaseEncrypted profile
  3. 03
    Databunker → File backendEncrypted file
YOUR APPLICATION STACKBusiness logic stays here
VAULT SERVICESelf-hosted or managed
CONFIGURED STORAGEChosen for your deployment

Your application

Backend / service

Sending a profile + file
Scoped credentialProfile + file

Application database

Your existing business data

customer_id1024
user_token—

Awaiting a record reference

Databunker Pro

The controlled retrieval boundary

01
Authenticated APIProfiles + attached files
02
Access policyEvaluate the caller’s permissions
03
Encryption + retrievalOriginals returned only when allowed
Encrypt before storage

Vault database

Encrypted customer records

PostgreSQLMySQLOracle

Separate from your application database

File backend

Encrypted file content

S3GCSAzure BlobLocal disk

Files linked to a customer record

01 / 04Playing

Originals go into the vault.

Your backend sends the profile and attached file through the authenticated API. Databunker encrypts their contents before writing to its configured storage.

ILLUSTRATIVE INPUT
profile: { name: "Alex Morgan" }
file: passport.pdf

The API credential authorizes the request.

READ THE MAP

Three boundaries.
Each with a job.

Tokenizing data changes where it is stored and how it is retrieved. It takes a deliberate integration in your application.

01 / YOUR APPLICATION

Keep business logic
where it belongs.

Your backend creates records and requests the values it needs. Your database keeps separate business records, such as orders and subscriptions, and a reference to the vaulted customer profile.

Application DB ≠ vault database
02 / THE VAULT SERVICE

Put a policy boundary
around the originals.

Databunker authenticates API calls, evaluates the configured permissions, and encrypts sensitive values at rest. Use scoped credentials for application access.

API · permissions · encryption
03 / VAULT STORAGE

Store encrypted records
and ciphertext files.

A supported relational database backs the vault. Attached files use local disk or a supported object store, with access going through Databunker.

Separate storage responsibilities
TWO TOKENS. DIFFERENT JOBS.

A reference points.
A credential permits.

Knowing a record token does not grant access to the record. The application sends a separate access credential with its API request.

The reference selects the record.
The policy controls what comes back.
AN AUTHORIZED READILLUSTRATIVE FLOW
WHICH RECORD?

Record reference

user_token: a21fa1d3…

Stored in your application database.

WHO IS CALLING?

Scoped credential

X-Bunker-Token

Kept in your application backend.

YOUR BACKEND
POST/v2/UserGet
DATABUNKER PRO

Evaluate permissions

Allowed fields

Access is defined by the configured policy, not by possession of a record reference.

RECORDS + FILES, TOGETHER

Same record.
Different permissions.

A profile in one database. An ID scan in another bucket. Bring them under the same controls, so access follows the person and the purpose.

Share only what’s needed

Mask fields and scope access to records and documents.

Give data a lifecycle

Set retention windows and enable profile version history.

Explore access controls
Customer workspacePOLICY EXAMPLE
AM

Alex Morgan

Customer #1024
In vault
View as
Email address***MASKED
National ID***MASKED
ATTACHED DOCUMENTS 2 FILES
passport.pdfIdentity document
Restricted
address-proof.pdfSupporting document
Restricted
Support access · masked profileDocument access restricted by this example policy
POLICY APPLIED

Support gets the context to help. Identity documents stay restricted.

ONE CUSTOMER, TWO KINDS OF DATA

Profiles in the vault.
Files attached to the person.

LINKED BY THE CUSTOMER RECORDAccess through Databunker
AMCUSTOMER RECORD

Customer #1024

a21fa1d3-…

One reference links the profile
and its supporting documents.

VAULT DATABASE

Structured profile

Names, emails, IDs and other customer attributes. Enable profile version history when needed.

nameemailcustomer attributes
Encrypted records
FILE BACKEND

Attached documents

Files linked to the customer and encrypted in the selected backend. File access is evaluated separately.

passport.pdfaddress-proof.pdf
Ciphertext files

Ready for implementation details?

Read the architecture docs
LESS SPRAWL. MORE CONTROL.

Give sensitive data
a proper home.

Walk through your architecture with a Databunker engineer.
Find the right place to start.

Book a demo Start a free trial
Managed trial · No credit card required