Privacy enabled runtime

An apparatus for securing data, the apparatus comprising:

• a memory;
• a communication interface;
• and
• an encryption engine, having an encryption unit and an analytics unit, communicably coupled with the memory and the communication interface, the encryption engine configured to:
• receive a request to apply cryptography to input data;
• generate metadata for the input data using the analytics unit, wherein the metadata identifies characteristics of content included in the input data;
• generate output data by applying a cryptographic technique to the input data;
• return the output data and the metadata in response to the request, wherein the encryption unit and the analytics unit are on separate hardware units,
• wherein the metadata includes a first metadata instance and a second metadata instance, the first metadata instance identifies a first set of characteristics in the input data, and the second metadata instance identifies a second set of characteristics in the input data, and
• wherein the encryption engine applies a first cryptographic technique to the first metadata instance and a second cryptographic technique to the second metadata instance, the first cryptographic technique being distinct from the second cryptographic technique;
• wherein the encryption engine further comprises a firewall, wherein the first metadata instance is decipherable by the firewall and the second metadata instance is not decipherable by the firewall.