Field-Level Data Masking
Protect sensitive data at the field level — emails, phone numbers, SSNs, and more are automatically masked so only authorized users see raw values. Everyone else sees obfuscated data by default.
Book a CallHow It Works
Server-Side Enforcement
Masking happens on the backend, not just the UI. Data is never exposed in API responses to unauthorized users.
Flexible Masking Types
Full mask (*******) or partial (j***@****.com) with configurable visible characters for each field.
Granular Access Control
Define who sees raw data based on user role or any custom property. Compliance officers see everything, support agents see masked values.
Zero Migration
Works with your existing databases. No schema changes needed — configure masking rules and they apply instantly.
Audit-Logged Access
Every time an authorized user views unmasked data, it is logged. Full traceability for compliance and security reviews.
Masking Types
| Field | Original | Masked | Type |
|---|---|---|---|
| john@acme.com | j***@****.com | Partial | |
| Phone | 415-555-4521 | ***-***-4521 | Partial |
| SSN | 123-45-6789 | ***-**-6789 | Partial |
| Name | John Smith | J***n S***h | Partial |
| Credit Card | 4532-1234-5678-9012 | ******* | Full |
| Password | myP@ssw0rd! | ******* | Full |
Real-World Use Case
A bank configures their customer table so that support agents see masked data — J***n S***h and j****@email.com — while only compliance officers with the admin role see the real values.
Available on Visionary ($250/mo), Build with You ($2,500/mo), Enterprise Plus, and Advanced plans.
Enterprise-grade masking controls
Per-user obfuscation permissions, impersonation safeguards, and builder-level masking -- ensuring sensitive data stays protected everywhere.
Per-user obfuscation permissions
Admins can now control, per user, whether a Creator or Compliance Officer is allowed to configure data masking rules. A simple toggle next to each user's role lets admins grant or revoke this permission -- ensuring only authorized team members can change what data is hidden or visible.
Impersonation always masks data
When an admin uses "View as User" to see the app from another user's perspective, all sensitive data is always masked -- regardless of that user's permissions. This ensures admins cannot use impersonation as a backdoor to view raw customer data, meeting PCI-DSS and SOC 2 compliance requirements.
Builder view respects masking
The database table view inside the app builder now respects the same masking rules configured for end users. Users without obfuscation permissions see masked data in the builder, closing a gap where raw data was previously visible during app configuration.