Masking pattern

Description

A Masking pattern describes how Mask fields replaces the values of a field. The transform only assigns a pattern to each field. The same pattern can be used in more than one pipeline.

Patterns are stored as JSON under metadata/masking-pattern/.

Properties

Property Description

Property	Description
Name	Name shown in the transform.
Description	What this pattern is for.
PII classification	A label for people working with the metadata. Suggested values are Direct identifier, Quasi-identifier, Sensitive and Special category. You can type another term. The transform does not read this value.
Value source	SYNTHETIC builds a token. SET_NULL clears the field. SET_EMPTY writes a blank string.
Token	SEQUENCE or UUID. Used by SYNTHETIC.
Prefix	Text written before the token on a string field, for example `first-name-`.
Suffix	Text written after the token on a string field.
Sequence start	First integer. The default is 1.
Remember values	NONE assigns a new value every row. MEMORY keeps the mapping for one run. DATABASE keeps it in a table across runs.
Ignore surrounding spaces	Values that only differ in leading or trailing spaces get the same replacement. A value of only spaces is left unchanged. Used by MEMORY and DATABASE.
Ignore case	Values that only differ in upper and lower case get the same replacement. Used by MEMORY and DATABASE.
Connection	Database connection for DATABASE.
Schema	Schema of the mapping table. Empty uses the connection default.
Table	Mapping table. A second table with the suffix `_seq` stores the next sequence number. Both are created when they are missing. A new mapping table holds masked values of up to 255 characters.
Hash secret	The mapping table stores an HMAC-SHA256 of each value, made with this secret, instead of the value itself. Use a variable such as `${MASKING_SECRET}`. Changing the secret starts a new mapping. Without a secret the table stores the original values and is itself personal data.

Name

Name shown in the transform.

Description

What this pattern is for.

PII classification

A label for people working with the metadata. Suggested values are Direct identifier, Quasi-identifier, Sensitive and Special category. You can type another term. The transform does not read this value.

Value source

SYNTHETIC builds a token. SET_NULL clears the field. SET_EMPTY writes a blank string.

Token

SEQUENCE or UUID. Used by SYNTHETIC.

Prefix

Text written before the token on a string field, for example first-name-.

Suffix

Text written after the token on a string field.

Sequence start

First integer. The default is 1.

Remember values

NONE assigns a new value every row. MEMORY keeps the mapping for one run. DATABASE keeps it in a table across runs.

Ignore surrounding spaces

Values that only differ in leading or trailing spaces get the same replacement. A value of only spaces is left unchanged. Used by MEMORY and DATABASE.

Ignore case

Values that only differ in upper and lower case get the same replacement. Used by MEMORY and DATABASE.

Connection

Database connection for DATABASE.

Schema

Schema of the mapping table. Empty uses the connection default.

Table

Mapping table. A second table with the suffix _seq stores the next sequence number. Both are created when they are missing. A new mapping table holds masked values of up to 255 characters.

Hash secret

The mapping table stores an HMAC-SHA256 of each value, made with this secret, instead of the value itself. Use a variable such as ${MASKING_SECRET}. Changing the secret starts a new mapping. Without a secret the table stores the original values and is itself personal data.