Open source · Deploy anywhere

Store tokens, not raw PII.

Aegis is a PII data privacy vault. Send sensitive values to the API, get back an opaque token, and store that instead. Role-based access, encryption, and audit logs — deploy it your way.

$ git clone https://github.com/anandukch/aegis.git
Quickstart
  • Open source
  • AES-256-GCM
  • JWT RBAC
  • Audit every read
Problem

Your database shouldn't hold plain emails and card numbers.

Apps need PII for support, billing, and identity — but storing raw values in Postgres spreads risk across every query, backup, and breach. The fix isn't vendor lock-in or opacity. It's a vault built on transparency and control.

Workflow

A simple loop for sensitive data.

Tokenize

Send the value, get a token

POST the raw email, phone, or card to the vault. Aegis encrypts it and returns an opaque token.

Store

Keep the token in your app DB

Your application stores only the token. Backups and logs never contain the original PII.

Detokenize

Retrieve with the right role

Authorized roles get full or masked values. Every access is logged — including denials.

What it handles

Built for privacy, access control, and audit.

Encryption

AES-256-GCM with a random nonce per record. Ciphertext without the master key is useless.

RBAC

Roles control who sees full values, masked values, or nothing at all.

Audit logs

Append-only trail of every store, detokenize, and delete — actor, IP, timestamp.

Masking

Analysts and viewers get redacted output. Admins and service roles get what they need.

Data types

Tokenize the fields that matter.

email phone card_number aadhaar pan name dob
Roles

Four roles. One access matrix.

  • ADMIN
  • ANALYST
  • SERVICE
  • VIEWER
Install

Run it on your own machine.

Clone the repo, set two secrets, and start with Docker. Postgres, migrations, and the API come up together. No vendor account required. 

git clone https://github.com/anandukch/aegis.git
cd aegis
cp .env.example .env
# set JWT_SECRET (32+ chars) and VAULT_MASTER_KEY (exactly 32 chars)

docker-compose up --build

API at http://localhost:8080 · health check /health