Cloud encryption gateways provide cloud security proxy (typically at the application level), which performs encryption, tokenization or both on an item-by-item basis as data flows through the proxy. The obfuscated (encrypted or tokenized) data can then be stored in a cloud-based software-as-a-service (SaaS) application, such as salesforce.com. Cloud encryption gateways typically provide a choice of various encryption and tokenization algorithms, depending on the strength of protection required and how much format preservation is necessary (for example, to preserve sorting).