Data masking
Column-pattern and content-regex masking rules, the three strategies, and why results are masked before they reach disk.
Updated:
Masking rules make sure PII never reaches a developer’s screen — or QueryProxy’s own storage. Rules are managed by DBAs under Masking.
Mask-on-write
Masking runs inside the result stream: as the worker cursors through a result set, every row is masked before it is written to the result file. The unmasked version of a result never exists on disk, so it can never be viewed, downloaded or leaked later. There is no “unmask” toggle by design.
Rule types
| Match type | Matches on | Example pattern |
|---|---|---|
| Column | The column’s name (case-insensitive wildcards; | separates alternatives) |
*email*, *password*|*secret*|*token* |
| Regex | The cell’s content (PCRE, with delimiters) | /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ |
Column rules win over content rules for the same value. Column rules also apply
to non-string values (a numeric card_number still gets masked); content rules
scan string values only.
Each rule is either team-wide or pinned to a single connection, and can be toggled on/off without deleting it.
Strategies
| Strategy | Result | Example |
|---|---|---|
full |
The whole value replaced | ***** |
partial |
Edges kept, shape preserved | a***@***.com, 5**********2 |
hash |
Deterministic SHA-256 prefix | sha256:9f86d081884c |
partial keeps emails readable (first letter + TLD); hash lets analysts
join/count on a column without seeing values.
Default rule set
One click (Add Default Rules) installs sensible defaults: email, phone and
card columns (partial), secret/token/password columns (full), plus content
regexes for emails and card numbers. Defaults are idempotent — adding them twice
creates nothing new.
Testing rules
The playground at the bottom of the Masking page previews your enabled rules: enter a column name and a sample value, see exactly what a result would show. Invalid regex patterns are rejected at save time — a broken pattern can never silently match nothing in production.