A vaulted architecture is a tokenization design in which a protected vault or mapping service stores the relationship between a surrogate token and the original sensitive value. When an authorized system needs the original value, it requests a lookup or detokenization through that service.
The vault is a high-value security boundary: unauthorized access could expose many underlying values or enable their recovery. Defenders should restrict and monitor access, secure administrative and API paths, and verify network segmentation. Systems that can query or influence the vault may remain security- or compliance-relevant even if they store only tokens. Tokenization can reduce data exposure, but the vault and the services connected to it still require strong controls.