A system for accessing data includes an interface and a processor. The interface is to receive a request to access data and requestor information. The processor is to determine whether the data comprises sensitive data configured to have an assigned access policy and an assigned storage policy; and in the event that the data comprises sensitive data configured to have the assigned access policy and the assigned storage policy, determine whether access is allowed based at least in part on the requestor information; and in the event that access is allowed, retrieve the data based on information provided by a token and provide the data.