End$-$of$-$day point$-$of$-$sale $($POS$)$ data is downloaded from wholesale$/$retail partner systems and saved onpremises. Data ingestion layer uses the encryption key held on$-$premises with Format$-$Preserving Encryption $($FPE$)$ mechanism to tokenize, anonymize, and map data flow for both structured and unstructured data, when additional protection is needed, before the data is sent to AWS. Data consumption layer uses the decryption key held onpremises to decrypt, de$-$tokenize, and map data flow back to its clear$-$text form before it is used by the onpremises applications or users.