Module compliance 

Data governance — cross-cutting compliance machinery.

Lives at the top level (like messaging/) because its consumers span every layer: HTTP responses (web), the audit trail (observability), outbox payloads (data), and dead-lettered messages (messaging).

Module	Responsibility
masking	PII redaction at every durable sink (#[MaskFields])
crypto	Field-level envelope encryption + crypto-shredding (#[EncryptFields])

Re-exports

pub use crypto::CryptoError;

pub use crypto::CryptoVault;

pub use crypto::DataKey;

pub use crypto::EncryptRecord;

pub use crypto::EncryptedField;

pub use crypto::KekSource;

pub use crypto::KeyId;

pub use masking::MaskRule;

pub use masking::MaskStrategy;

pub use masking::Masker;

pub use masking::MaskingPolicy;

Modules

crypto

Field-level envelope encryption + crypto-shredding.

masking

PII masking — classification-driven redaction at every data sink.