Updated for 2026
The Audit Verification Problem
External reviewers must check the numbers behind financial reports. To do that, they need the source records.
Hard redaction removes those records for good. There is nothing left to check. The review process breaks. Permanent removal tools create this problem: they protect information by destroying its usefulness.
Reversible token masking fixes both. Sensitive fields — client names, deal terms, company IDs — get swapped for tokens. The reviewer gets clean files. The real values stay reachable via a time-limited access key.
See our legal alignment overview and token system guide for how this works end to end.
How Scoped Access Works
The model fits any review engagement.
The finance team swaps out sensitive fields before sharing. The lead reviewer gets a scoped access key tied to that job. During the review, they can match tokens to real values. They can trace figures back to source records.
When the review closes, the access key is rotated and revoked. The reviewer's copies cannot be decrypted. Former staff who leave after close cannot reach old records. Technical controls enforce scope — not just contracts.
Key Rotation as Governance
Revoking the access key after each job creates a logged control. That control satisfies several governance rules at once.
SOX compliance: SOX Section 302 requires officers to certify that controls work. Rotating the access key after each job is such a control. It can be checked in a SOX review.
ISO 27001 Annex A.10.1.1: The standard requires key management steps covering expiry, rotation, and revocation. Tying each rotation to job close meets this cleanly.
GDPR data minimization: GDPR Article 5(1)(e) says records must not be kept past their purpose. Once the review ends, revoking the access key satisfies this. The records still exist. They are just locked without a new key for a new purpose.
See our protection overview for how these rules map to the token model.
The February 2026 SDNY Ruling
The Heppner ruling (S.D.N.Y. Feb. 17, 2026) found that AI-processed documents lose privilege. They must be protected before processing. Sending them to an outside processor counts as disclosure.
The same logic applies to financial records. Sharing them with reviewers without a technical control counts as disclosure. Reversible token masking is that control. It lets the review run without exposing raw data.
The Five-Step Model
The process is simple:
- Sensitive fields are tokenized before any external sharing.
- The reviewer receives a scoped access key valid only for that job.
- The review runs on tokens. The reviewer can check real values as needed.
- At close, the access key is rotated and logged.
- The token map goes into retention. New access needs a new issuance.
No raw records leave the organization in readable form. The reviewer still gets what they need. And the organization keeps records that satisfy SOX, ISO 27001, and GDPR at once.
See our entity detection approach and plans and rates for more details.
When This Approach Has Limits
Tokenizing sensitive fields and revoking the access key at job close is a genuine control that maps cleanly onto SOX, ISO 27001, and GDPR. But the model supports those frameworks rather than satisfying them outright, and three limits apply.
The tool supports compliance; it does not constitute it. Rotating the access key produces evidence of a control, but a SOX or ISO 27001 attestation rests on the auditor's own judgment, your documented procedures, and how consistently the control is operated across every engagement. A single tokenized export does not make a process certified. Treat reversible masking as one control in a wider program, and keep the policy, training, and exception-handling records that an assessor will actually test.
Tokenizing identifiers does not always blind the numbers. Audits exist to verify figures, so the reviewer often needs deal terms and amounts in the clear. Those retained values, combined with dates, counterparties, and transaction sizes, can re-identify a masked client even when the name is a token. The output is pseudonymized, not anonymized, and stays in GDPR scope with the legal duties that follow. Decide deliberately which fields must remain readable for the audit and which can be suppressed.
Revocation depends on copies you no longer control. Rotating the key blocks decryption of files the reviewer still holds, but it cannot reach a plaintext value already exported to a spreadsheet, a screenshot, or a working paper during the engagement. Custody control at close is not the same as having prevented exposure during the review. Pair key rotation with contractual handling terms and a record of what the reviewer was shown.
Sources
- United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026) — Debevoise Data Blog
- Sarbanes-Oxley Act Section 302 — SEC full text
- ISO 27001:2022 Annex A.10.1.1 — ISO catalog
- GDPR Article 5(1)(e) — GDPR-Info
- IAPP: Financial services data governance and reversible anonymization — IAPP