Masking
Keep the joins.Change the people.
DOGM masking replaces names, emails and ID numbers with stand-ins, and the same input always gets the same stand-in in every table, so joins keep working. The demo masks names and emails in your browser, and hosted runs apply a spec's mask block with your project's key. For data you already hold, dogm mask applies every mode below on your own machine, from a CLI you build from source until its first release.
Consistent masking
Same person in,same stand-in out.
Bea Castillo appears in two tables. After masking she's Tala Mercado in both, and her customer ID still joins her tickets to her account. Every value here is fictional.
Before
| customer_id | full_name | |
|---|---|---|
| CUS-000731 | Bea Castillo | bea.castillo@example.com |
| CUS-000058 | Jun Villanueva | jun.villanueva@example.com |
| reply_id | ticket_id | author_name |
|---|---|---|
| RPL-0002210 | TCK-000415 | Bea Castillo |
| RPL-0000184 | TCK-000415 | Jun Villanueva |
After
| customer_id | full_name | |
|---|---|---|
| CUS-000731 | Tala Mercado | tala.mercado@example.com |
| CUS-000058 | Paolo Dizon | paolo.dizon@example.com |
| reply_id | ticket_id | author_name |
|---|---|---|
| RPL-0002210 | TCK-000415 | Tala Mercado |
| RPL-0000184 | TCK-000415 | Paolo Dizon |
- 01Names share one domain, so a name masks the same way wherever it appears.
- 02The email is rebuilt from the masked name in the same row.
- 03Keys are kept here; if you mask a key, every column that references it must use the same mode, or the spec is rejected.
Modes
Pick a modeper column.
Every masked column names its mode. A column with no safe mode gets redact; a column you leave alone gets keep, so the report shows someone looked at it.
| Mode | What it does | Use for |
|---|---|---|
| consistent | Picks a replacement from the domain's fictional pool, using a keyed hash of the value. | Names, cities, anything with a pool |
| consistent + from | Rebuilds the value from another masked column in the same row. | An email next to the name it belongs to |
| fpe_ff1 | FF1 format-preserving encryption (NIST SP 800-38G). Keeps length and character classes; masked keys still join. | TIN, SSS, account numbers, numeric keys |
| hash | Keyed hash, truncated to hex, with an optional prefix. | Opaque IDs that do not need to look real |
| shift_date | Moves dates by a keyed offset per entity, so every date for one person shifts together and intervals survive. | Birthdates, event dates |
| redact | Replaces the value with null or a constant. | Free text, notes, anything without a safe mode |
| keep | No change, recorded explicitly. | Columns that are not sensitive |
Version 1 can't reliably find personal data inside free text, so a text column marked as personal data must use redact.
Local first
Your key.Your machine.
To mask data you already hold, you run dogm mask where the data lives. The key is a file on your machine, and raw rows never reach DOGM.
$ dogm mask mask.yaml --in ./prod-export --out ./masked --key-file key.binReads what you export
CSV or JSONL files, read in bounded batches, so a large table never sits in memory at once.
One key, one mapping
The key is 32 random bytes you supply. A new key version gives a new mapping, and runs record which version they used.
Free on every plan
The CLI and local masking have no limits and need no account.
CLI, from source dogm mask is in the CLI, which you build from source until its first release. DOGM doesn't mask real data on its servers.
What masking is
Pseudonymization,not anonymization.
Masked data is safer to share inside a team, but it isn't anonymous and it isn't safe to publish.
What it does not guarantee
- Anyone with the key can rebuild the mapping for a list of candidate values.
- Rare values and how often values appear can still identify people.
- Columns left unmasked can combine to identify someone.
Under the Data Privacy Act of 2012
Masked personal data is still personal data. Treat a masked export with the same care as the source it came from.
Early-access beta
Try the demo now.Or start free.
The in-browser demo generates, masks and checks a connected sample, and nothing leaves your browser. Sign up and your workspace gets Pro limits at no cost while the beta lasts.