Cloakr
Database copies ready for testing, with no personal data inside.
Cloakr reads the production database, applies a masking rule to every sensitive column and writes the result to a destination database. It runs in your cluster.
Request a demo
Algorithms
Six techniques, chosen column by column
Every column in a template gets its own algorithm. On any rule you can enforce uniqueness and a maximum length, so the destination database constraints stay valid.
| Algorithm | What it does | Example |
|---|---|---|
| Substitution | Replaces first and last names with values from Italian dictionaries (over 9,000 first names and 21,000 surnames). | Mario Rossi→Luca Bianchi |
| Deterministic | The same input always gives the same output (HMAC-SHA256): useful for keys and fields used in joins. | [email protected]→DMASK-4422a879eb2ccb9c |
| Regular Expression | Built-in rules for emails, cards, Italian tax codes and phone numbers, or a pattern of your own. | RSSMRA80A01F205X→RSS************X |
| Shuffling | Replaces each character with a random one of the same kind, keeping format and spacing. | 333 1234567→807 5521938 |
| Truncation | Cuts the value to a maximum number of characters. | Via Garibaldi 21, Lecco→Via Gari |
| Nulling Out | Replaces the value with NULL, for fields staging does not need. | IT60X0542811101…→NULL |
| Randomization | Replaces numbers and dates with random values of the same magnitude, keeping the column type. | 42000→33289 |
Execution
When and on what it runs
On demand
Run the job when you need a fresh environment, for example before a release.
Scheduled
The job repeats at fixed intervals and keeps staging up to date with no manual work.
Continuous, via CDC
Changes in production reach the destination already masked, through Change Data Capture.
Files
Upload a CSV, XLSX or JSON file, map the columns and download the masked version.
Supported as source and destination
AI suggestions
AI proposes the rules, but never sees your data
On schemas with hundreds of columns, Cloakr can propose which algorithm to use for each one. You review and approve the proposal.
- What is sent to the model
- Table and column names, data types, and the list of available algorithms.
- What is not sent
- No values, no rows. Database content never leaves your environment.
- Which model
- The one you configure at install time (Azure AI Foundry). If you don't configure it, the feature stays off.
FAQ
Questions we get asked often
- Does production data go through your servers?
- No. Cloakr is installed in your Kubernetes cluster and only reads from and writes to the databases you configure. We have no access to your data.
- Do foreign keys still work after masking?
- Yes. Cloakr loads tables in dependency order, and with the deterministic algorithm the same value is masked the same way in every table.
- Is masked data anonymous under GDPR?
- It depends on the techniques you choose. In most cases the result is pseudonymisation: it greatly reduces risk, but the data is still personal data. We go through it during the assessment, column by column.
Roadmap
Under evaluation
Priorities depend on what the teams we work with ask for.
NoSQL databases
Support for MongoDB and other document databases.
Managed cloud deployment
Simpler installation on the main public clouds.
Let's see it on your data.
Tell us which databases you use and how you build test environments today. You'll hear back from us, not a sales rep.