Build your solution

Now that you’ve defined your solution, you can start building it. During this stage, you’ll build your solution in your Sandbox instance of Skyflow, test integrations with the other components of your architecture, and review the security of your solution with Skyflow to harden compliance requirements before moving to production.

Integrate Skyflow into your systems

Integrating Skyflow into your systems is a multi-step process that involves setting up authentication, configuring roles and policies, integrating server-side and client-side components, and implementing additional processing/external integration features as needed.

Implement authentication and configure data governance together to minimize gaps in access control and data management. Start by identifying the necessary personas or roles for your solution and set up users or service accounts accordingly. This approach allows you to define specific roles and permissions, ensuring users access only the data and functionalities they need. As you establish authentication, you may uncover additional needs or constraints that can refine your data governance policies, and vice versa.

Step 1: Set up authentication

To use Skyflow’s Management API, Data API, or SDKs, you need a JWT bearer token (recommended) or an API Key to authenticate your API calls.
You can generate a bearer token using one of the following:

• Skyflow SDKs
• Skyflow Studio
• Python script

Unless your use case requires you to use an API key, use bearer tokens. Bearer tokens are time-limited—they’re valid for only 60 minutes—and are therefore considered more secure than traditional API keys, which are long-lived.

Step 2: Configure roles and policies

Data Governance is a set of capabilities that enable customers to finely control access to sensitive data. Skyflow lets you define custom roles and policies for access control to ensure compliance and security.

During this process, you must do the following:

1. Create new custom roles as needed to specify exactly who gets which privileges.

2. Refer to the policy expression language reference and define custom access policies in Skyflow Studio or via the Create Policy API.

   Sample policies:

   • A frontend service account with permissions to create/insert and tokenize:

     1
     ALLOW CREATE, ALLOW TOKENIZATION TABLE.*

   • A back-end service account with permissions to read and detokenize:

     1
     ALLOW READ ON TABLE.COLUMN WITH REDACTION = MASKED

     1
     ALLOW DETOKENIZATION ON TABLE.COLUMN WITH REDACTION = MASKED

     For more examples of policies to use, refer to the policy catalog.

3. Attach your policies to your roles.

4. Assign your custom roles to users and service accounts, as needed.

If you generate a bearer token with a Get Bearer Token request, you can enhance security by limiting the token’s permissions through role specification. Define the scope of the request by specifying a subset of available roles, using a string format to include the desired roles, such as ‘role:{roleID1} role:{roleID2}’.

Security tip: As you define additional access controls for your data, keep the following best practices in mind:

• Differentiate between user and application accounts.
• Build your service accounts and user permissions to follow the principle of least privilege. Give the lowest privileges possible so that you grant access only for necessary permissions.
• Create separate service accounts for administration and for application runtime.

Step 3: Integrate server-side components

When it comes to integrating Skyflow with server-side components, you have two options:

• APIs: Manage your data, your vaults, and your account with Skyflow’s APIs.
• Server-Side SDKs: Skyflow’s server-side SDKs offer seamless integration for your back-end systems, making it easier to securely manage sensitive data. These server-side SDKs facilitate secure data retrieval and management, ensuring that sensitive data remains protected throughout its lifecycle.

Step 4: Integrate client-side components

You also have two options available when integrating Skyflow in client-side components:

• Elements: Skyflow Elements are building blocks for creating UI forms that collect sensitive data, such as credit card information, without exposing it to the back-end.

  Security tip: If your use case requires storing payment data, Skyflow Elements, client-side SDKs, and Server-side SDKs can help reduce the complexity of PCI compliance and enhance data security.

• Client-Side SDKs: Skyflow’s client-side SDKs enable you to securely collect, tokenize, and reveal sensitive data directly in the browser, all without exposing your frontend infrastructure to any sensitive information.

Step 5: Insert test data

Skyflow offers various options to easily get data into vaults, providing various ways to control data ingestion. You can transfer data into vaults with Skyflow Studio, APIs or SDKs.

You can import data into your vault in several ways:

• Insert records in Studio
• Insert data using the Insert Records API
• Upload files
• Bulk import records
• Connections
• Pipelines

Step 6: Implement additional features as needed

Implement processing and integration features as needed to meet your solution requirements.

Securely integrate with external APIs

Skyflow Connections is an HTTPS gateway service that uses Skyflow’s tokenization capabilities to securely connect to first-party and third-party services. You can configure a Skyflow Connection in two modes:

1. Outbound connection: Outbound connections bridge the integration between your back-end server and a third-party service provider. The configuration lets your server securely extract data from the vault and send it to third-party services for processing.
2. Inbound connection: Inbound connections serve as an intermediary between your client and back-end infrastructure. Client services can invoke an inbound connection to tokenize sensitive data, pass the tokenized data to your server, and prevent downstream services from containing the sensitive data.

Note: Skyflow needs to review and whitelist all third-party URLs (outbound base URLs) for Connections before you can use them in production environments. If your solution uses Connections, reach out to your point of contact at Skyflow to whitelist the required outbound third-party URLs.

Add custom logic for your data

Functions let you process sensitive data by adding custom logic to your Connections. With functions, you can develop custom code using Node.js to perform tasks such as:

• Data validations
• Data transformations
• Data processing
• File creation or modification

Once you upload your custom code, you can deploy this code to your environment and invoke the deployment using a Connection.

Process large volumes of data securely with your vault

Pipelines are a prescriptive solution that can securely transfer large volumes of sensitive data from a source system to your vault. Pipelines enable batch workflows that securely transfer large volumes of sensitive data from a source system to a vault.

Pipelines can also de-identify sensitive data during migration. By calling Skyflow APIs, you can create and trigger pipelines without hosting or provisioning compute resources while minimizing the risk of exposing your infrastructure to sensitive data.

Pipelines support the following features:

• Sources and destinations: Pipelines connect to S3 buckets, FTPS servers, and SFTP servers.
• Formats: Pipelines support CSV and JSON files.
• Mappings: Pipelines map CSV, JSON, ACH, and METRO2 values to columns in your vault.
• Triggers: Pipelines trigger on-demand for one-time or ad-hoc pipeline runs.

Here are some examples of how you can use pipelines:

• Migrate PCI data in bulk from existing payment processors to prevent PCI vendor lock-in.
• Tokenize data in Skyflow vaults when consuming ACH and METRO2 financial services files so that you don’t expose your backend to any PCI data.
• Migrate PII data in bulk from existing customer data sources into a vault.
• Migrate PII data tokens from existing tokenization vendors.

Test and validate your solution

Once you have completed development, test your solution to make sure it meets security and compliance requirements.

While you should be testing throughout the development process, it’s especially important to thoroughly test everything in Sandbox before you can move to Production. Comprehensive testing validates that your solution functions as needed and fits securely into your architecture.

During this process, you must do the following:

1. Conduct thorough end-to-end testing for your solution.
2. Address any issues found during testing.
3. Update your custom roles and policies, as needed.

After testing your solution, the next step is to conduct a quick security review with Skyflow to review your solution and security best practices.

Complete security review

Before you migrate to your production instance, it’s important make your solution is as secure as possible before going live.

During this process, you must do the following:

1. Review the recommended security best practices checklist for your solution.

   Note: See PCI compliance walkthrough if you store payment data.

2. After you complete the checklist, schedule a security review with Skyflow to validate compliance with security standards. During this meeting, Skyflow reviews your solution and provides guidance to help improve compliance and security.

3. Implement the suggested changes.

Next steps

Once you’ve built and tested your end-to-end solution in your Sandbox instance of Skyflow, the final step is to go live.