A system, comprising: at least one computing device (104, 204, 304, 404, 504) implementing one or more services and one or more backend services (108, 208, 308, 408, 508, 708, 808, 908), wherein the one or more services: receive, over a cryptographically protected communications session, a set of data objects directed towards the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908), where the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908) expose one or more endpoints for various types of sensitive data; determine that a subset of data objects of the set of the data objects includes sensitive data based at least in part on configuration information provided by the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908), wherein the configuration information comprises information suitable for identifying sensitive data, thereby enabling detection of sensitive data, indicates an endpoint to transmit sensitive data based at least in part on a type associated with the sensitive data, and indicates a cryptographic key associated with the endpoint; determine, based at least in part on a type of sensitive data, an endpoint to which to transmit the sensitive data, and a cryptographic key associated with said endpoint; obfuscate the subset of data objects, using the determined cryptographic key, to generate a set of encrypted data objects which can be decrypted by the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908) that expose the endpoint; modify the set of data objects to include the set of encrypted data obj ects, together with a flag or marker to indicate the presence of encrypted data objects, thereby generating a modified set of data objects; and transmit the modified set of data objects to the endpoint exposed by the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908). receive, over a cryptographically protected communications session, a set of data objects directed towards the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908), where the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908) expose one or more endpoints for various types of sensitive data; determine that a subset of data objects of the set of the data objects includes sensitive data based at least in part on configuration information provided by the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908), wherein the configuration information comprises information suitable for identifying sensitive data, thereby enabling detection of sensitive data, indicates an endpoint to transmit sensitive data based at least in part on a type associated with the sensitive data, and indicates a cryptographic key associated with the endpoint; determine, based at least in part on a type of sensitive data, an endpoint to which to transmit the sensitive data, and a cryptographic key associated with said endpoint; obfuscate the subset of data objects, using the determined cryptographic key, to generate a set of encrypted data objects which can be decrypted by the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908) that expose the endpoint; modify the set of data objects to include the set of encrypted data obj ects, together with a flag or marker to indicate the presence of encrypted data objects, thereby generating a modified set of data objects; and transmit the modified set of data objects to the endpoint exposed by the one or more backend services (108, 208, 308, 408, 508, 708, 808, 908).