Masking & tokenization
Keeping real customer data out of development environments, analytics sandboxes, and ad hoc extracts is a constant challenge at scale. This masks or tokenizes sensitive values inside the connector, before anything moves, so downstream systems only ever receive the protected form. The raw value never reaches the platform either, because the platform holds metadata only, and your rows never reach it.
Masking is applied at the source, inside the connector, so the raw value never crosses into a downstream copy or into the platform itself.
Rules bind to sensitivity labels, so a newly classified column is masked by policy without anyone reconfiguring a pipeline.
Tokenization keeps analytics working: consistent tokens preserve joins and counts while the real value stays behind.
Each masking or tokenization step is recorded on lineage as an anonymizing hop, so the label can step down with evidence.
The pipeline fails closed: if the connector cannot confirm the rule applied, the data does not move.
Keys stay yours through bring-your-own-key, and air-gapped deployment is supported.
Bind
Masking rules attach to labels, so coverage follows classification rather than pipeline-by-pipeline setup.
Apply
The connector masks or tokenizes at read time, before data leaves the source system.
Record
The hop lands on lineage as an anonymizing transformation and is sealed on the ledger.
Watch
An expected masking hop that goes missing raises an issue, and closure is verified with evidence rather than declared.
“Can developers see real customer data in the lower environments?”
No. Masking and tokenization are applied inside the connector before data leaves the source system, so lower environments only ever receive the protected form.
“How do I prove this extract was masked before it left the source?”
Each masking or tokenization step is recorded on lineage as an anonymizing hop and sealed on the ledger. That record shows the rule applied at the source, before the data moved.
“What happens if a masking rule fails mid-pipeline?”
The pipeline fails closed: if the connector cannot confirm the rule applied, the data does not move. An expected masking hop that goes missing also raises an issue, and that issue closes only when evidence verifies the fix.
Start with proof, not a promise.
There are three ways in, and each one earns the next. You approve the exit criteria before we spend any more of your time or budget.
A 60-minute working session
Bring one report that is expensive to prove. We walk the mechanism against it. Nothing is required from your side.
A two-week guided sandbox
Your team works hands-on against a synthetic sample bank. It requires zero access to your systems and zero procurement.
A six-week proof on your systems
We use read-only metadata across five systems and one priority report, scored against criteria both sides sign first. The decision it produces is yours.