You must implement a low-latency tokenization service that detects duplicate cards without storing plaintext and supports annual key rotation. Which storage approach should you use?

Encrypting card data with a deterministic algorithm ensures that the same plaintext input always produces the same ciphertext. This is crucial for detecting duplicate cards without storing the original plaintext, as you can compare the encrypted values directly. Firestore (Datastore mode) offers low-latency access and scalability, making it suitable for a tokenization service. It also supports annual key rotation by re-encrypting data with a new key. Storing card data in Secret Manager after a query for duplicates is inefficient and not designed for high-volume data storage and querying. Sharding across multiple Memorystore instances would provide low latency but lacks the persistent storage and querying capabilities needed for duplicate detection across a large dataset. Using column-level encryption in Cloud SQL is an option, but Firestore (Datastore mode) offers better scalability and lower latency for this specific use case of tokenization and duplicate detection.