Shield is an enterprise-grade data privacy layer that encrypts and tokenizes sensitive PII inside the Stuut platform. It uses the same architectural approach as Salesforce Shield — a dedicated privacy vault that sits on top of the platform. You hold the keys, control access, and can delete all your data instantly by revoking the key.

Shield Standard uses Stuut-managed encryption keys — you get the privacy vault and tokenization, but we manage the keys. Shield BYOK lets your team bring your own encryption keys, giving you full data sovereignty. Even Stuut engineers can't access your PII with BYOK.

Revoke your encryption key and every tokenized record becomes permanently unreadable — instantly, provably, everywhere. No manual data scrubbing, no hunting down records across systems. You get a deletion certificate for compliance documentation.

Shield Standard is 10% on top of your platform fee. Shield BYOK is 20%. For a $150K platform deal, BYOK adds $30K for full data sovereignty and key ownership.

SOC 2 confirms that a vendor encrypts data — but the vendor still holds the keys. Shield gives you key ownership, which means you control the data lifecycle end to end. It's the difference between trusting your vendor and verifying it yourself.

No. The privacy vault and tokenization layer are built into the platform — not bolted on. Encryption and decryption happen in real-time with no impact to matching speed, posting time, or user experience.

Healthcare teams handling HIPAA-covered billing data. Financial services firms under SOC 2 audit. Defense contractors managing CUI. Our Shield solution serves any AR team in a regulated industry with strict data privacy requirements.