# Data masking

> Column-pattern and content-regex masking rules, the three strategies, and why results are masked before they reach disk.

- Documentation: Guides
- Updated: 2026-09-07
- Source: https://queryproxy.com/docs/data-masking/
- Language: en-US
- Author: Muhammet ŞAFAK

---
Masking rules make sure PII never reaches a developer's screen — or QueryProxy's
own storage. Rules are managed by DBAs under **Masking**.

## Mask-on-write

Masking runs **inside the result stream**: as the worker cursors through a
result set, every row is masked *before* it is written to the result file. The
unmasked version of a result never exists on disk, so it can never be viewed,
downloaded or leaked later. There is no "unmask" toggle by design.

## Rule types

| Match type | Matches on | Example pattern |
| :-- | :-- | :-- |
| **Column** | The column's name (case-insensitive wildcards; `\|` separates alternatives) | `*email*`, `*password*\|*secret*\|*token*` |
| **Regex** | The cell's content (PCRE, with delimiters) | `/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/` |

Column rules win over content rules for the same value. Column rules also apply
to non-string values (a numeric `card_number` still gets masked); content rules
scan string values only.

Each rule is either **team-wide** or pinned to a single connection, and can be
toggled on/off without deleting it.

## Strategies

| Strategy | Result | Example |
| :-- | :-- | :-- |
| `full` | The whole value replaced | `*****` |
| `partial` | Edges kept, shape preserved | `a***@***.com`, `5**********2` |
| `hash` | Deterministic SHA-256 prefix | `sha256:9f86d081884c` |

`partial` keeps emails readable (first letter + TLD); `hash` lets analysts
join/count on a column without seeing values.

## Default rule set

One click (**Add Default Rules**) installs sensible defaults: email, phone and
card columns (`partial`), secret/token/password columns (`full`), plus content
regexes for emails and card numbers. Defaults are idempotent — adding them twice
creates nothing new.

## Testing rules

The **playground** at the bottom of the Masking page previews your enabled
rules: enter a column name and a sample value, see exactly what a result would
show. Invalid regex patterns are rejected at save time, and patterns that risk
catastrophic backtracking (ReDoS) are rejected too — a broken or runaway pattern
can never silently match nothing in production.

Regex masking also **fails closed**: if a pattern cannot be evaluated against a
value at runtime, that value is **masked, not emitted raw** — masking never
falls open on the pathological data it most needs to protect.