Skyflow and the case for less exposure

Before Scalapay chose Skyflow, it did something sensible: it counted the engineers. Building the basics of its own privacy system would take three specialists between six and twelve months. Keeping it running would require two engineers afterward. Then came the outside compliance advisers. For an installment-payment business, this was a considerable detour.

The immediate problem was a familiar commercial one. Scalapay was growing across Europe, and keeping its payment data tied to one processor was becoming expensive and restrictive. The company had begun building a proxy to help it move that data. What gave way first was the convenience of having a processor hold the cards. As volumes rose, convenience began to look like dependence.

The card number is the clue

Skyflow offered a different arrangement. Capture the sensitive payment information, replace it with tokens, and keep the originals in a governed vault. Scalapay could call APIs to supply payment information to processors while keeping those details out of its own backend database. It gained room to choose processors without building the privacy machinery from scratch.

That is a useful introduction to Skyflow, founded in 2019 by Anshu Sharma, Prakash Khot and Roshmik Saha. Sharma and Khot came from Salesforce; Saha brought experience from Microsoft and Lyft. Their inspiration included the privacy vault architectures used at Apple and Netflix. The ambition was to make that approach available through an API, much as developers buy payment infrastructure.

The product addresses an awkward habit of modern software: copying personal information into every system that might conceivably use it. A name lands in an application, then a warehouse, then a support workflow. Skyflow separates sensitive values from the systems working around them. Those systems can use tokens, masked fields or approved access to originals, depending on policy.

A vault with a working door

A sealed box would be easy to secure and difficult to sell. Businesses still need to verify identities, process payments and analyze customer behavior. Skyflow combines tokenization, access controls and what it calls polymorphic encryption: different encryption and de-identification techniques chosen to preserve useful operations. Developers integrate through APIs and SDKs rather than inventing the entire system themselves.

The distinction matters in the market. A payment processor can hold card details; a cloud platform can encrypt storage; an identity system can decide who logs in. Skyflow sells a layer for governing sensitive fields across applications, clouds and workflows. Its competition includes those existing capabilities and, perhaps most persuasively, the engineering team convinced it can build the missing pieces.

Its product range follows those workflows: a Data Privacy Vault for personal information, financial-data tools for payments and onboarding, healthcare protection, regional storage and controls for AI agents. The partnerships page lists AWS, Google Cloud, Databricks, Boomi, MuleSoft and Plaid. Privacy infrastructure earns its keep inside systems a customer already uses.

The bill nobody puts on the roadmap

GoodRx supplies a second view of the economics. In a Skyflow-published customer account, CTO Nitin Shingate says deployment took less than three weeks and total cost of ownership fell 67%. These are customer-reported results, not a universal savings schedule. Still, the comparison puts a price on the work that otherwise disappears into engineering budgets.

Skyflow sells to businesses through negotiated contracts. Its pricing guidance names platform fees, numbers of data subjects, localization regions and feature requirements as inputs. The buyer is paying for software, specialist infrastructure and the maintenance burden it takes off the internal team. Whether that trade pays depends on the workflows, geography and sensitive-data footprint involved.

Consider data residency. Skyflow proposes keeping sensitive information in regional vaults while other infrastructure works with tokens. The attraction is avoiding a copy of the entire application stack in each market. That requires careful decisions about which data stays where and who can recover original values. The vault supplies controls; the company still has to design the policy.

Then the chatbot needed a name

Generative AI made this architectural question harder to postpone. An assistant may need customer context to finish a task, yet sending every original value to a model creates another place for sensitive data to travel. Skyflow for Agents sits between data sources, MCP connections, models and tools. It sanitizes information and restores original values only when policy permits.

The expansion attracted capital. In March 2024, Skyflow announced a $30 million Series B extension led by Khosla Ventures. Earlier rounds included a $45 million Series B led by Insight Partners. In a January 2026 profile, Insight put total equity capital at $100 million and described nearly a billion user-data records and more than two billion quarterly API calls. Those figures describe a dated investor account.

In August 2026, Skyflow announced a Glean integration protecting data before indexing and enforcing controls during retrieval. Kearney was connecting client work for thousands of consultants, each with confidentiality obligations. Document permissions alone leave another question: which particular fields should appear when an AI system turns several documents into one answer?

A March 2026 Coralogix partnership tackles an ordinary nuisance: logs. Remove every identifier and engineers struggle to connect events. Leave the originals and troubleshooting becomes another source of exposure. Consistent tokens preserve relationships between events, while access to the underlying values remains governed. The appeal is practical: an investigation can continue without handing everyone the customer’s details.

“We need to have a trust layer.”Anshu Sharma · Insight Partners interview, January 2026

Copy the separation

The lesson a reader can borrow is a design question: does this workflow require the original value, or merely a reliable reference to it? Ask it before copying data into the next tool. A payment needs authorized access to a card; a report may need only a stable customer token. Treating both requests identically is how unnecessary copies accumulate.

There are limits to the bargain. A vault cannot protect a copy that bypasses it. An overly broad permission can still expose an original value. Migration, integration latency and the operational dependence on another service deserve testing in the buyer’s own environment. Small teams with little sensitive data may find their existing platform sufficient. Skyflow’s case grows stronger when several systems need to use the same sensitive information under different rules. That is where the stand-in becomes valuable: it lets more work happen with less exposure.