A system for accessing data includes and interface and a processor. The interface is configured to receive a request to move stored data to a new location and requestor information. The stored data comprises sensitive data. The processor is configured to determine whether read access, storage access, and deletion access are allowed based at least in part on the requestor information; in the event that read access, storage access, and deletion access are allowed: read the sensitive data at an original location using an original token, store the sensitive data to the new location and receive a new token associated with the new location, and delete the original token and the sensitive data at the original location.