Below is the architecture for a data protection service. It provides a Hold Your Own Key $($HYOK$)$ solution to enable customers who require additional data$-$centric protection measures to address more stringent privacy regulations, such as not storing encryption keys in AWS.

End$-$of$-$day point$-$of$-$sale $($POS$)$ data is downloaded from wholesale$/$retail partner systems and saved onpremises. Data ingestion layer uses the encryption key held on$-$premises with Format$-$Preserving Encryption $($FPE$)$ mechanism to tokenize, anonymize, and map data flow for both structured and unstructured data, when additional protection is needed, before the data is sent to AWS. Data consumption layer uses the decryption key held onpremises to decrypt, de$-$tokenize, and map data flow back to its clear$-$text form before it is used by the onpremises applications or users.