HANDLING SENSITIVE DATA IN AN APPLICATION USING EXTERNAL PROCESSING

A method and system for handling sensitive data required by an application in a secure computer system. The secure computer system transforms sensitive data in a request message from a data format required by the application into a data format required by a service in an external computer system. The secure computer system tokenizes the sensitive data by replacing the sensitive data with tokenized data and stores a mapping between the sensitive data and the tokenized data in the secure computer system. The secure computer system sends the request message to an external computer system and receives, from the external computer system, a response message that includes annotations for the tokenized data with transform instructions for transforming the transformed sensitive data from the data format required by the service into the data format required by the application. The secure computer system replaces the tokenized data with the sensitive data.