Techniques for replacing a token with a mask value are disclosed. In an embodiment, a masking engine is implemented by a cloud application. The cloud application receives, from a client device, a request for a data value associated with a data field. The masking engine determines that a set of data stored in association with the data field corresponds to a token format. The cloud application transmits a mask value, rather than the set of data, towards the client device. In an embodiment, a masking engine is implemented by a client device and/or a data residency proxy. The masking engine receives a set of data for display at an interface of the client device. The masking engine determines that the set of data corresponds to a token format. The masking engine causes a mask value, rather than the set of data, to be displayed at the interface.