What this is, exactly. A demonstration of the mechanisms, not the production system.
The real one holds its keys inside an HSM (FIPS 140-3 Level 3) where no software ever sees them; a browser cannot do
that, so the demo key here is generated when the page loads and thrown away when you leave.
Nothing you type leaves this page, and nothing is stored. Use made-up details — never a real child's.
1. One person, one token, everywhere
Same person in, same token out — in every state and every dataset. Different person, different token. And no way back: the token is produced with a key, and without the key it cannot be reversed.
2. No one can open it alone
The vault key is split among seven independent holders. Any four together can reconstruct it. Three learn nothing — not a partial key, not a hint. Choose holders and watch.
Shares held: 0 of 7 · quorum is 4
3. Evidence cannot quietly disappear
The design test from the specification: if evidence enters this system, it must be impossible for anyone — including the operators — to make it quietly disappear. Every entry carries the hash of the one before it. Edit any entry below, or delete one, and watch what happens.
| When | Who | What (editable — try it) | Hash |
|---|
Ask your encryption team for these by name
| Ask for this | What it does |
|---|---|
| Deterministic tokenization | Same person → same token, everywhere. HMAC-SHA-256 or format-preserving encryption (FF3-1). |
| HSM (FIPS 140-3 L3) | Tamper-resistant hardware that holds the keys so they never appear in software. |
| Threshold / Shamir shares | The vault key split among many holders; a quorum must combine shares to open it. |
| Privacy-preserving record linkage | Matching the same person across states and datasets without ever exposing names. |
| Confidential computing / secure enclave | Data stays encrypted even while being processed in memory. |
| Append-only tamper-evident log | Every access permanently recorded; any alteration is detectable. WORM storage + hash chain. |
| Separation of duties / break-glass | Auditors touch only tokens; re-identification needs quorum + legal cause + full logging. |