1. A method comprising: intercepting, by a tokenization gateway computer-based system, sensitive data prior to the sensitive data reaching a cloud application, wherein the cloud application is in an externally hosted system, wherein the cloud application comprises a software application that functions within the externally hosted system, wherein the externally hosted system includes a cloud computing environment, associating, by the tokenization gateway computer-based system, a file path with the sensitive data; generating, by the tokenization gateway computer-based system, a token comprising a data identifier; tokenizing, by the tokenization gateway computer-based system and in response to the generating, the sensitive data; storing, by the tokenization gateway computer-based system and in response to the tokenizing, the token to the cloud application; storing, by the tokenization gateway computer-based system and in response to the storing the token to the cloud application, the sensitive data to a token vault, wherein the token vault is internal to the tokenization gateway computer-based system, and wherein the token vault comprises a data storage system; retrieving, by the tokenization gateway computer-based system, the token from the cloud application; reading, by the tokenization gateway computer-based system, the file path associated with the token; and in response to the reading the file path associated with the token, receiving, by the tokenization gateway computer-based system, the sensitive data.