Q

xAQUA

2.0

For Government
Sign In
Get Demo
Products › Governance › SenseMask · PII Masking
🎭 SenseMask — PII Detection & Masking 85+ Templates Governance · Vigil

Sensitive data. Hidden. Forever.

Detect. Classify. Mask. Done.

SenseMask auto-detects every type of sensitive data — PII, PHI, FTI, financial — and applies the right masking policy. Databases, documents, test environments alike. Compliance frameworks mapped out of the box. No custom regex. No field-by-field tickets. No leaks.

Built for privacy officers, CISOs, and the engineers who've been told "just mask the PII" — without anyone explaining how, where, or which fields.

See SenseMask in action → Request Demo ↓ Download Brochure PDF · 385 KB
🎭
SenseMask
Auto-detect · Classify · Mask
Scanning
customer.ssn PII · SSN
BEFORE 123-45-6789
AFTER XXX-XX-6789
patient.diagnosis PHI · ICD-10
BEFORE E11.9 · Type 2 diabetes
AFTER [REDACTED]
payment.card_number FTI · PCI
BEFORE 4532 1098 7654 3210
AFTER **** **** **** 3210
✓ 3 columns masked · 847 records updated · relationships preserved · audit trail logged.
SenseMask at work
85+
Mask Templates
4
Sensitivity Classes
3
Masking Methods
100%
Audit Coverage
Docs + DBs
Both Covered
Why SenseMask Exists

Privacy isn't a review. It's a default.

Most masking happens too late — after a test environment already has production PII, after a report already went to a partner with SSNs, after a CSV already left the building with PHI. Security teams become tax collectors. Developers route around them.

SenseMask shifts the default. Every new dataset is scanned. Every sensitive column is classified. Every downstream copy gets the right mask — substitute, redact, partial — automatically, with referential integrity preserved for the tests that still need to run.

Privacy officers own the policy. SenseMask owns the execution.

The old way
You mask the columns you remember. The rest leak.
01
Regex in scripts. One-off SQL. A Python notebook someone wrote in 2019 that nobody touches.
02
Dev clones of production. PHI in test. SSNs in a staging bucket. Nobody tracks the copies.
03
When the auditor shows up, nobody can prove which columns were masked, when, or by whom.
What SenseMask Detects

Every type of sensitive data.

Auto-classification across structured, semi-structured, and documents. Custom types for your domain.

PII
Personal Information
Direct and quasi-identifiers that can re-identify an individual.
SSN · names · emails · phone · DOB · addresses · national IDs
PHI
Protected Health
HIPAA-regulated health information linked to an individual.
diagnoses · ICD / CPT codes · medications · providers · claim IDs
FTI
Federal Tax Info
IRS-protected data under IRC 6103 — stringent handling required.
tax returns · TINs · W-2 data · refund amounts · audit records
Financial
Financial Info
Account and payment data under PCI-DSS and banking rules.
card numbers · CVV · routing · balances · transaction IDs
Biometric
Biometric Identifiers
Unique biological data — GDPR, BIPA, and CCPA in scope.
fingerprints · face IDs · voice prints · retina scans
Device
Device & Location
Digital identifiers that enable tracking or re-identification.
IP addresses · MAC · IMEI · device IDs · GPS coordinates
Credentials
Secrets & Credentials
Authentication material — never belongs in logs or test data.
passwords · tokens · API keys · client secrets · session IDs
Custom
Your Domain Types
Define sensitive types specific to your business. SenseMask learns and classifies.
benefit IDs · case numbers · member IDs · internal IDs
What SenseMask Does

Detection, classification, masking — automated.

🔎
Auto-Classification
Scans every column, field, and document. Classifies against PII, PHI, FTI, Financial, and your custom types — with confidence scores and human review queues.
  • Pattern, dictionary, and ML-based detection
  • Confidence scoring with review workflow
  • Custom type definitions for your domain
🎭
Three Masking Methods
Substitute with realistic fakes. Redact completely. Partial-mask (keep last 4 of SSN, leading zeros of ZIP). Choose per column, per environment, per use case.
  • Substitute · realistic synthetic values
  • Redact · irreversible removal
  • Partial mask · keep format, lose content
🔗
Preserve Data Relationships
Consistent tokenization keeps joins working. Same source SSN always maps to the same masked value — across every table, every environment. Referential integrity, preserved.
  • Consistent masking across tables
  • Referential integrity for tests
  • Format-preserving encryption option
📑
Documents + Structured Data
Not just tables. PDFs, Word docs, contracts, reports — SenseMask finds the PHI buried in a claim narrative and masks it, keeping the document readable and the identity private.
  • PDF, Word, Excel, CSV
  • Contracts, claim narratives, reports
  • 39+ document types processed at scale
📋
85+ Compliance Templates
Pre-built mask sets for SOC 2, HIPAA, GDPR, CCPA, PCI-DSS, GLBA, FERPA, IRS Pub 1075. Pick the framework, get the mask set, customize from there.
  • Framework-aligned defaults
  • Editable per tenant, per policy
  • Version-controlled policy library
📜
Jobs & Audit Trails
Batch jobs, schedules, and on-demand runs. Every mask operation logged: who, what, when, how many rows, which policy. Auditors get a report, not a scavenger hunt.
  • Scheduled and triggered jobs
  • Full operation audit trail
  • Auditor-ready evidence packs
Three Masking Methods

One size never fits all.

Pick the right method for the right column. Mix and match per environment.

SUBSTITUTE
Realistic Fakes
Replace values with realistic synthetic equivalents. Same format. Same distribution. Same joins. Keeps test environments useful without exposing real data.
BEFORESarah Chen
AFTERMartha Ellis
BEFOREsarah@acme.com
AFTERmartha@example.com
REDACT
Total Removal
Value gone. Replaced with a fixed placeholder. Use when the data adds no analytical value — diagnoses in billing exports, free-text comments in claim narratives.
BEFOREType 2 diabetes
AFTER[REDACTED]
BEFOREPatient notes: ...
AFTER[REMOVED]
PARTIAL MASK
Format, Not Content
Keep the shape, lose the payload. Last-4 of SSN for support lookups. Leading digits of ZIP for regional analysis. Masked card PAN for receipts.
BEFORE123-45-6789
AFTERXXX-XX-6789
BEFORE4532 1098 7654 3210
AFTER**** **** **** 3210
Compliance · Built In

Map to the frameworks your auditors care about.

Pre-built SenseMask policies aligned to the regulations you have to defend. Ship compliant from day one.

SOC 2
Service organization controls. Security and confidentiality principles.
PII masking · audit evidence · access logs
HIPAA
US health information. Safe-harbor de-identification for analytics and research.
PHI redaction · 18 identifiers · BAA-aligned
GDPR
EU data protection. Subject rights, pseudonymization, data minimization.
DSR support · pseudonymization · erasure
CCPA · CPRA
California privacy rights. Sensitive personal information handling.
SPI classification · opt-out · deletion
PCI-DSS
Payment card data. Cardholder data masking and tokenization.
PAN masking · scope reduction · tokenize
IRS Pub 1075
Federal Tax Information. Stringent handling for tax authorities.
FTI classification · access logs · audit
GLBA
US financial institutions. Non-public personal information (NPI).
NPI detection · masking · safeguards rule
FERPA
US student education records. Identifier and record protection.
student PII · grades · transcripts
Use Cases

Where SenseMask earns its keep.

🧪
Safe Test & Dev Environments
Engineering · QA · UAT
Production clones without production PII. Developers get realistic data — same shape, same distributions, same joins — without ever touching a real SSN, claim, or card.
✓ Referentially-intact masked environments, on demand
📤
Cross-Team & Partner Sharing
Data clean rooms · vendor exports
Analytics teams, consultants, and partners need the data — not the identities. SenseMask ships the shape and masks the sensitive bits, every time, consistently.
✓ Share insights. Keep identities.
📋
Regulatory Reporting & Audit
SOC 2 · HIPAA · GDPR · IRS 1075
When auditors arrive, SenseMask hands over the evidence pack — every mask, every job, every policy, every access — already aligned to the framework in question.
✓ Audit responses in days, not weeks
🔬
Analytics on Sensitive Data
Research · BI · AI/ML training
De-identified datasets for actuarial modeling, risk scoring, and ML training. Preserves distribution and correlation; protects individual re-identification.
✓ Models trained on privacy-safe data
Why SenseMask

Not another masking tool.

SenseMask is a governance module in a unified platform — not a bolt-on that ships PII to its own engine, masks it there, and sends it back.

Data stays in your boundary
SenseMask runs next to the data — in your VPC, your lake, your warehouse. Nothing is shipped out to be masked.
Referential integrity · guaranteed
Consistent tokenization across tables, across environments, across runs. Joins keep working. Test data stays useful.
Documents + structured · one tool
Most tools do one or the other. SenseMask masks the PHI in the claim record and in the claim narrative PDF.
Compliance-aligned defaults
85+ templates pre-mapped to SOC 2, HIPAA, GDPR, PCI, IRS 1075, and more. Pick a framework, get a policy.
Human-in-the-loop review
Low-confidence classifications get routed to a steward. Over time, SenseMask learns your domain — custom types become first-class.
Audit trail · every operation
Who ran it. What policy. Which columns. How many rows. Every mask is evidence. Every job is a receipt.
SenseMask + Vigil

Policy in plain English. Masks at scale.

SenseMask is the masking engine. Vigil — xAQUA's AI Data Governance Agent — turns a privacy officer's policy into live mask jobs, watches for new sensitive data, and maintains the audit record.

Ask Vigil: "mask all SSN columns for testing." Vigil finds them (including the ones in column names like taxpayer_id), applies the right mask method, preserves relationships, and hands back a report.

Meet Vigil · The AI Data Governance Agent →
Ask Vigil Governance Agent
👤
Mask all SSN columns across our test environments.
Found 14 SSN columns across 9 tables (4 not named "ssn"). Applied PARTIAL_MASK · keep last 4.

· Consistent tokenization — joins verified across all 9 tables
· 2.4M rows masked in 41s
· 0 failures · audit record #MK-8824 logged

Ready for QA. Original values never left prod.

Stop shipping sensitive data.

See SenseMask classify a live dataset, apply a compliance-mapped policy, and produce a referentially-intact masked copy — with a full audit pack — in under fifteen minutes.

Request a SenseMask Demo → Meet Vigil ↓ Download Brochure PDF · 385 KB