Identity Vault

Securely store and manage sensitive PII data like Social Security Numbers, Tax IDs, and passport numbers.

Overview

The Identity Vault provides enterprise-grade encryption for PII. Data is encrypted with AES-256-GCM before storage and can only be retrieved by authorized services. Your servers only ever receive a token.

Supported Identity Types

Type	Format	Description
`ssn`	XXX-XX-XXXX	Social Security Number
`ssn_last4`	XXXX	Last 4 digits of SSN
`ein`	XX-XXXXXXX	Employer Identification Number
`itin`	9XX-XX-XXXX	Individual Taxpayer ID
`passport`	Alphanumeric	Passport Number
`drivers_license`	Varies	Driver’s License Number
`national_id`	Varies	National ID Number
`tax_id`	Varies	Generic Tax ID
`custom`	Any	Custom sensitive field

React SDK Integration

Use the IdentityElement component to collect PII in your React app:

import { AtlasProvider, IdentityElement } from '@atlas/react';

function CustomerOnboarding() {
  const handleTokenize = async (token) => {
    console.log('SSN tokenized:', token.token_id);
    console.log('Masked value:', token.masked_value); // •••-••-6789

    // Send token_id to your server
    await fetch('/api/customers/update', {
      method: 'POST',
      body: JSON.stringify({ ssn_token: token.token_id })
    });
  };

  return (
    <AtlasProvider publishableKey="pk_test_xxx">
      <form>
        <label>Social Security Number</label>
        <IdentityElement
          type="ssn"
          placeholder="123-45-6789"
          onTokenize={handleTokenize}
          onError={(error) => console.error(error)}
        />

        <label>Employer ID (EIN)</label>
        <IdentityElement
          type="ein"
          placeholder="12-3456789"
          onTokenize={handleTokenize}
        />

        <button type="submit">Continue</button>
      </form>
    </AtlasProvider>
  );
}

API Reference

Tokenize Identity

Securely tokenize PII data. The value is encrypted with AES-256-GCM before storage.

curl -X POST https://api.atlas.co/functions/v1/tokenize-identity \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "ssn",
    "value": "123-45-6789",
    "field_name": "primary_ssn",
    "metadata": {
      "customer_id": "cus_abc123"
    }
  }'

Response:

{
  "token_id": "id_a1b2c3d4e5f6...",
  "type": "ssn",
  "masked_value": "•••-••-6789",
  "field_name": "primary_ssn",
  "created_at": "2025-01-21T12:00:00Z",
  "environment": "test"
}

Retrieve Identity (Server-side only)

Decrypt and retrieve the original PII value. Requires a secret key - only call from your backend.

curl -X POST https://api.atlas.co/functions/v1/retrieve-identity \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "token_id": "id_a1b2c3d4...",
    "reason": "tax_filing_1099",
    "format": "formatted"
  }'

Response:

{
  "token_id": "id_a1b2c3d4...",
  "type": "ssn",
  "value": "123-45-6789",
  "field_name": "primary_ssn",
  "masked_value": "•••-••-6789",
  "created_at": "2025-01-21T12:00:00Z"
}

Proxy Identity to Third Parties

Send PII directly to partners without your servers ever seeing the raw data.

curl -X POST https://api.atlas.co/functions/v1/proxy-identity \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "token_id": "id_a1b2c3d4...",
    "destination": "https://api.checkr.com/v1/candidates",
    "headers": {
      "Authorization": "Bearer checkr_api_key"
    },
    "body_template": {
      "ssn": "{{value}}",
      "first_name": "John",
      "last_name": "Doe"
    },
    "reason": "background_check"
  }'

Response:

{
  "success": true,
  "token_id": "id_a1b2c3d4...",
  "destination": {
    "host": "api.checkr.com",
    "status": 201,
    "response": {
      "id": "candidate_abc123",
      "status": "pending"
    }
  }
}

Allowed Destinations:

api.checkr.com
api.plaid.com
api.gusto.com
api.persona.com
api.alloy.com
api.onfido.com

Contact support to add custom destinations. Delete tokenized PII for privacy compliance. Soft Delete (keeps audit trail):

curl -X POST https://api.atlas.co/functions/v1/delete-identity \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "token_id": "id_a1b2c3d4...",
    "reason": "customer_request"
  }'

Hard Delete (GDPR right to be forgotten):

curl -X POST https://api.atlas.co/functions/v1/delete-identity \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "token_ids": ["id_abc123", "id_def456"],
    "mode": "hard",
    "reason": "gdpr_erasure_request"
  }'

List Identity Tokens

Query tokens with filtering and pagination. Returns metadata only - never returns decrypted values.

curl -X GET "https://api.atlas.co/functions/v1/list-identity-tokens?type=ssn&is_active=true&limit=50" \
  -H "Authorization: Bearer sk_test_xxx"

Response:

{
  "tokens": [
    {
      "token_id": "id_a1b2c3d4...",
      "type": "ssn",
      "field_name": "employee_ssn",
      "masked_value": "•••-••-6789",
      "is_active": true,
      "created_at": "2025-01-21T12:00:00Z",
      "last_accessed_at": "2025-01-21T14:30:00Z"
    }
  ],
  "pagination": {
    "total": 150,
    "limit": 50,
    "offset": 0,
    "has_more": true
  }
}

Node.js SDK

import { Atlas } from '@atlas/node';

const atlas = new Atlas('sk_test_xxx');

// Tokenize
const token = await atlas.identity.tokenize({
  type: 'ssn',
  value: '123-45-6789',
  field_name: 'employee_ssn',
});

// Retrieve
const data = await atlas.identity.retrieve(token.token_id);

// Proxy to third party
await atlas.identity.proxy({
  token_id: token.token_id,
  destination: 'https://api.checkr.com/v1/candidates',
  body_template: { ssn: '{{value}}' },
});

// Delete
await atlas.identity.delete(token.token_id);

// List
const result = await atlas.identity.list({ type: 'ssn' });

Security

AES-256-GCM encryption - Data encrypted before storage
Audit logging - All access is logged with reason
Access controls - Retrieval requires secret key
GDPR/CCPA compliant - Hard delete removes all data
SOC 2 Type II - Enterprise security controls

Getting Started

Payments

UI Components

Billing

Data & Security

Mobile

Developer

Identity Vault

Overview

Supported Identity Types

React SDK Integration

API Reference

Tokenize Identity

Retrieve Identity (Server-side only)

Proxy Identity to Third Parties

List Identity Tokens

Node.js SDK

Security

​Overview

​Supported Identity Types

​React SDK Integration

​API Reference

​Tokenize Identity

​Retrieve Identity (Server-side only)

​Proxy Identity to Third Parties

​Delete Identity (GDPR/CCPA)

​List Identity Tokens

​Node.js SDK

​Security

Overview

Supported Identity Types

React SDK Integration

API Reference

Tokenize Identity

Retrieve Identity (Server-side only)

Proxy Identity to Third Parties

Delete Identity (GDPR/CCPA)

List Identity Tokens

Node.js SDK

Security