When the data has to
come from production.
Synthetic data covers most testing. For the rest, GoMask masks and subsets live databases with referential integrity intact, from a UI or from YAML in your repo.
# masking rules live in the repo, run in CI source: postgres://prod-replica/crm target: postgres://staging/crm subset: where: customers.created_at > now() - interval '90 days' mask: customers.email: fpe.email customers.full_name: person.name cards.pan: fpe.card # keeps BIN, passes Luhn audit: true
Generate it, or mask it?
Four things it does, each explained once.
Masking, discovery, subsetting and rules as code. Each one explained once.
Format-preserving encryption keeps joins, lengths and checksums intact. The same input masks to the same output across every table and run.
Scans schemas and samples to propose which columns carry personal data, then lets a human confirm before anything is masked.
Pull a coherent slice of production, with every foreign key satisfied, instead of a full copy.
Rules in YAML, versioned in Git, executed in your pipeline. Preview a run before it touches a target.
What it connects to today.
Native connectors are listed; everything else is reached through drivers on request.
What you can hold us to.
The commitments that matter when the source is production.
Encryption in transit and at rest, role-based access control, and an audit log on every run. A data processing agreement is available on request.
Read the DPA →Managed cloud, your private VPC, or on-prem. Masking runs next to the source; nothing leaves the boundary you choose.
Book a demo →Built for GDPR and HIPAA workloads: deterministic masking keeps referential integrity while personal data never reaches a test environment.
Privacy policy →
PostgreSQL
MySQL
Oracle
MongoDB
Snowflake
Databricks
BigQuery
GitHub Actions
Parquet
Thirty minutes with a solutions engineer.
Bring a schema. We will show masking rules drafted against it, a subset run, and the audit log it produces. No deck.