A system for securing data, the system comprising: one or more processors; and a memory having stored thereon instructions that, when executed by the one or more processors, cause the one or more processors to: receive (402; 502), from a requesting application (302,304,306), a request for data over a network, the request comprising a call to a secure-data Application Program Interface, API, and the call comprising an indication of confidential portions of data within the requested data; identify (404; 504), based on the call to the secure API, one or more confidential portions of data within the requested data; determine, based on a policy for providing data to the requesting application, whether the identified one or more confidential portions of data are to be secured; transmit, based on the result of the determination, the confidential portions of data to a hardware device (316;318) configured to secure the confidential portions of data; and receive, from the hardware device (316;318), secured data generated based on the transmitted confidential portions of data from the hardware device and provide the requested data, including the secured data, to the requesting application. one or more processors; and a memory having stored thereon instructions that, when executed by the one or more processors, cause the one or more processors to: receive (402; 502), from a requesting application (302,304,306), a request for data over a network, the request comprising a call to a secure-data Application Program Interface, API, and the call comprising an indication of confidential portions of data within the requested data; identify (404; 504), based on the call to the secure API, one or more confidential portions of data within the requested data; determine, based on a policy for providing data to the requesting application, whether the identified one or more confidential portions of data are to be secured; transmit, based on the result of the determination, the confidential portions of data to a hardware device (316;318) configured to secure the confidential portions of data; and receive, from the hardware device (316;318), secured data generated based on the transmitted confidential portions of data from the hardware device and provide the requested data, including the secured data, to the requesting application. receive (402; 502), from a requesting application (302,304,306), a request for data over a network, the request comprising a call to a secure-data Application Program Interface, API, and the call comprising an indication of confidential portions of data within the requested data; identify (404; 504), based on the call to the secure API, one or more confidential portions of data within the requested data; determine, based on a policy for providing data to the requesting application, whether the identified one or more confidential portions of data are to be secured; transmit, based on the result of the determination, the confidential portions of data to a hardware device (316;318) configured to secure the confidential portions of data; and receive, from the hardware device (316;318), secured data generated based on the transmitted confidential portions of data from the hardware device and provide the requested data, including the secured data, to the requesting application.