Typical implementations involve two core components: a secure environment which hosts the sensitive data to be protected, and a cryptographic proxy, which securely redirects the encryption of the host process of the insecure environment to a cryptographic provider within the secure environment which hosts the sensitive data.
From the server's perspective, the request appears like any other regular keyed-in request.