Tokenize card numbers

Unity Catalog functions swap sensitive values for format-preserving tokens, while the key stays in DuoKey, never on the cluster.

Column-level

Protect individual columns in a Lakehouse table, not disks or VMs.

Same shape

Tokens keep length and character shape, so schemas and joins keep working.

Key off the cluster

The Databricks cluster never handles the key-encryption key.

Two SQL functions in Unity Catalog.

Setup generates Spark SQL that registers tokenize and detokenize functions; at query time they call DuoKey's tokenization service over HTTPS.

Configured once per workspace, from the Cockpit.
Your queries call tokenize() like any function.

Tokens that keep the shape of your data.

A token has the same length and character shape as the value it replaces, so format checks and joins keep working on tokenized columns.

16 digits in, 16 digits out for card numbers.
Separators kept in email addresses.

The key never reaches the cluster.

Only values and tokens travel. The key-encryption key stays in DuoKey, and the tokenization key is derived per tenant and per named key.

Nothing to protect on the cluster.
Revoke access centrally.

Detokenize only for those allowed.

detokenize is a Unity Catalog function like any other: grant EXECUTE only to the roles that need original values, and analysts keep working on tokens.

Least privilege with the permissions you already use.
Every call goes through the DuoKey tokenization service.

How it works

Two SQL functions in Unity Catalog. The key stays in DuoKey.

DuoKey protects individual columns in a Lakehouse table, not disks or VMs. Setup generates Spark SQL that registers tokenize and detokenize functions; at query time they call DuoKey's tokenization service over HTTPS.

Setup · once per workspace, from Cockpit

DuoKey Cockpit

Workspace, catalog, schema

Generated Spark SQL

Ready to run

Unity Catalog

tokenize / detokenize UDFs

Query time · over HTTPS

Your SQL query

Calls tokenize()

DuoKey tokenization

Returns the token

Key-encryption key

Never leaves DuoKey

The Databricks cluster never handles the key-encryption key. The tokenization key is derived per tenant and per named key from a platform master key, and is never stored in a vault.

Format-preserving

Tokens that keep the shape of your data

A token has the same length and character shape as the value it replaces, so schemas, queries, joins and format checks keep working on tokenized columns.

Card numbers

16 digits in, 16 digits out

A 16-digit card number becomes another 16-digit sequence that still fits the column.

Email addresses

Separators kept

An email keeps its @ and domain separators, so format validation still passes.

Round trip

detokenize()

Detokenizing returns the original value, in the same format.

Setup

From Cockpit to working UDFs in five steps

Describe the target

Enter the workspace URL, the target catalog and schema, and a data-type hint for the columns.

Get the SQL

DuoKey returns SQL that creates the catalog and schema if needed and registers the UDFs.

Store the API token

Create a Databricks secret with a DuoKey API token and expose it to Spark in the cluster configuration.

Run the DDL

Execute the generated statements in the target catalog and schema.

Check the round trip

Tokenize, then detokenize a sample value and confirm you get the original back.

Operations

Check the integration from Cockpit

The integration lives in the Cockpit Apps catalog. The same tokenization service also has Snowflake and generic-secret variants on the Tokenization page.

Enable or disable

Switch the integration on or off from Cockpit.

Health check

Reports configuration and readiness, including that the UDF template is in place.

Self-test

Confirms the key-encryption key stays in DuoKey, never in Databricks.

Column-level scope

Only the columns you tokenize change; the rest of the table stays as it is.

Removing the integration does not detokenize your data

It disables the UDFs, but values already written as tokens stay tokens. Detokenize what you need in the clear first, or keep the tokenization service available.

Requirements

What you need

Read the setup guide

A Databricks workspace with Unity Catalog
The right to run the generated DDL in the target catalog and schema
A DuoKey user with tokenization access and an API token
The right to create a Databricks secret and edit the cluster configuration

Deep dives

Field guides for your programme

You're Encrypting Your Data. But Who Controls the Keys?

Encrypted is not the same as controlled: a plain-language brief for leaders on who can unlock cloud data when a provider holds the last key.

Read guide

Enterprise Key Management: Key Management Systems, KMaaS, HSM and MPC (2026 Guide)

Enterprise key management explained: what a key management system does, its components, KMaaS vs HSM vs cloud KMS, how to choose and how to roll it out.