Tokenization is not a dramatic encryption trick, but a design choice that replaces sensitive values with surrogates and keeps the real data in a vault.