The problem
Handling sensitive payment and identity data at scale brings strict regulatory obligations. The system needed to protect that data end to end, satisfy PCI DSS compliance, and do so without becoming a bottleneck for high-volume transaction traffic.
What I built
I designed and built an enterprise tokenization service that replaces sensitive values with non-sensitive tokens, backed by a hardware security module (HSM) so that encryption keys never leave secure hardware. The service exposes a FastAPI interface for tokenize and detokenize operations, integrates with Thales HSM infrastructure, and is engineered to hold throughput steady under sustained load.
Key focus areas were correctness under concurrency, careful key-management boundaries, and keeping latency low enough that the tokenization step stayed invisible inside the wider transaction flow.
Outcome
The platform sustained more than 1,000 transactions per second while meeting PCI DSS compliance requirements — security and performance held together rather than traded off against each other.