Skyflow protects sensitive data such as personal, health and payment information as it moves through enterprise applications, analytics platforms, AI models and agents. It is for companies that want to build and run AI and data products without exposing customer data along the way.
The problem is that useful data products need sensitive data, and every copy of that data is a new chance of a leak or a compliance breach. Skyflow lets companies keep using the data while the real values stay protected.
At A Glance
| Vendor | Skyflow |
|---|---|
| Category | AI data security |
| Identities covered | Sensitive data (PII, PHI, PCI) accessed by applications, users and AI agents |
| Agentic AI | Skyflow for Agents: MCP data protection, agent identity based access, memory and context sanitisation |
| Customers | ServiceNow, Visa, Flipkart, GoodRx, Kearney |
| Certifications | ISO 27001:2022, SOC 2 Type II, PCI DSS Level 1 |
| Founded | 2019, Palo Alto, California |
| Market classification | AI Data Security; also Privacy & Decentralised Identity, Data Security |
What Skyflow Does
Sensitive data no longer stays in one database. It is copied into analytics tools, used to train and ground models, and passed to agents that call other tools, and each step is a new place where it can leak. Agents make this harder, because they pass data between tools on their own.
The platform deals with this at runtime. It finds sensitive values in databases, documents and analytics platforms and turns them into tokens, so the data can still be joined, queried and used, while the real values stay in the vault. Originals are restored only where policy allows, based on who or what is asking and in what context. The same approach applies whether the consumer is an application, an analyst, a model or an agent, and whether data must stay in a particular country.
Products
Data Privacy Vault (PII)
The vault is for teams that need to isolate, protect and govern customer PII in one place. It de-identifies data with polymorphic encryption and tokenisation, and grants column-level and row-level access in privacy-safe formats, with IP address restrictions. Analysts can query PII without decrypting it, producing masked datasets for reporting.
Skyflow For Agents (Agents And AI Security)
Companies building AI products use Skyflow for Agents to keep sensitive data out of models and agents. It detects, classifies and sanitises PII, PHI and PCI data in real time and applies field-level privacy across MCP connections without changes to the applications. Protection covers the whole AI lifecycle, from data collection and fine-tuning to retrieval augmented generation and inference, and original values are rehydrated only where policy permits. Sensitive values are also kept out of prompts, context graphs and an agent’s short-term and long-term memory, and each agent sees only what its own identity and context allow.
Skyflow For Healthcare And Skyflow For Payments
Healthcare organisations use Skyflow for Healthcare to protect PHI and support HIPAA obligations. Skyflow for Payments takes card data out of a company’s own systems to reduce the scope of PCI compliance work, with Skyflow Connections passing tokenised card data to payment APIs.
Data Residency
Global companies use data residency to keep sensitive data in a given region and enforce cross-border restrictions without running a separate instance per country. Residency locations include the US, Germany, India and China.
How It Works
Skyflow sits between a company’s data sources, MCP servers, agents and models, and controls what sensitive data each of them can see.
| Component | What it does |
|---|---|
| Polymorphic engine | A patented engine masks, sanitises and rehydrates data in real time based on policy, identity and context. |
| Data privacy vault | Sensitive values are held in the vault and replaced with tokens in the rest of the stack. |
| Regional vaults | Vaults run in specific regions to meet residency rules. |
| Developer components | A Data API and Management API, client-side SDKs that collect sensitive data directly from the client, Connections to downstream APIs, Pipelines for bulk processing and Functions for running custom code that transforms data. |
Identities And Systems Covered
| AI agents | Access decisions tied to agent identity and runtime context |
|---|---|
| Models | ChatGPT, Claude, Gemini and the major agentic frameworks |
| Agent protocols | MCP, A2A and APIs |
| Sensitive data types | PII, PHI, PCI and BII across structured and multi-modal data |
| Data platforms | Databases, documents, Snowflake, Databricks and Google BigQuery |
| Agent memory and context | Short-term and long-term memory, prompts and context graphs |
Integrations
| Area | Integrations |
|---|---|
| Cloud | AWS, Google Cloud |
| Enterprise applications | ServiceNow, HubSpot, Glean |
| Payment APIs | Stripe and Adyen, through Skyflow Connections |
Company Background
| Founded | 2019 |
|---|---|
| Headquarters | Palo Alto, California |
| Leadership | Anshu Sharma (Co-founder and CEO), Roshmik Saha (Co-founder, Engineering), Amruta Moktali (Chief Product Officer) and Daniel Wong (Chief Security Officer) |
| Funding | $30 million Series B extension led by Khosla Ventures, with Mouro Capital, Foundation Capital and Canvas Ventures (March 2024) |
| Compliance | In addition to the certifications above, HIPAA assessed, GDPR assessed and the EU-US Data Privacy Framework; supports HIPAA, PCI, GDPR, DPDP, CCPA and CPRA obligations |
Note: This overview is compiled from Skyflow’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.