Embodiments of the present invention provides a data protection solution which can efficiently tokenize sensitive data submitted by a user device to a public cloud and de-tokenize any tokenized response from the cloud. A small, in-memory token map may be looked up to facilitate the two-way conversions between sensitive data and tokenized data. The token map can be flexibly configured, it may be generated and/or changed on the fly, and its design could preserve data format and provide multilingual support. The innovative tokenization process is fast, secure, scalable through cloud-native design but less costly as compared to prior approaches.