Skip to main content
Live Data Masking

​
What You’ll Accomplish

Live Data Masking automatically detects and redacts sensitive data in your query results. Unlike traditional DLP solutions that require complex rule configuration, Hoop’s data masking works out of the box:
  • Automatically detect PII (names, emails, phone numbers, SSNs)
  • Mask credit card numbers and financial data
  • Redact passwords, API keys, and secrets
  • Protect health information (HIPAA compliance)
  • No regex patterns to write or maintain

​
How It Works

1

Query Executed

User runs a query through Hoop
2

Results Analyzed

AI scans the query results for sensitive data patterns
3

Data Masked

Sensitive values are replaced with redacted placeholders
4

Results Returned

User sees masked results; original data never exposed

​
Before and After

Original query result: 
| name         | email              | ssn         | phone        |
|--------------|--------------------| ------------|--------------|
| John Smith   | john@example.com   | 123-45-6789 | 555-123-4567 |
| Jane Doe     | jane@company.org   | 987-65-4321 | 555-987-6543 |
With Live Data Masking enabled: 
| name         | email              | ssn         | phone        |
|--------------|--------------------| ------------|--------------|
| [REDACTED]   | [REDACTED]         | [REDACTED]  | [REDACTED]   |
| [REDACTED]   | [REDACTED]         | [REDACTED]  | [REDACTED]   |

​
Quick Start

​
Prerequisites

To get the most out of this guide, you will need to:
  • A DLP provider configured (Microsoft Presidio or GCP DLP)

​
Step 1: Set Up a DLP Provider

Choose and deploy one of the supported providers:

Microsoft Presidio

Open-source, self-hosted PII detection

Google Cloud DLP

Managed service with advanced detection
See Live Data Masking Configuration for detailed setup instructions.

​
Step 2: Configure the Gateway

Set the required environment variables: For Microsoft Presidio: 
DLP_PROVIDER=mspresidio
DLP_MODE=best-effort
MSPRESIDIO_ANALYZER_URL=http://presidio-analyzer:5001
MSPRESIDIO_ANONYMIZER_URL=http://presidio-anonymizer:5002
For Google Cloud DLP: 
DLP_PROVIDER=gcp
DLP_MODE=best-effort
GCP_PROJECT_ID=your-project-id

​
Step 3: Enable on a Connection

  1. Go to Connections in the Web App
  2. Select a connection and click Configure
  3. Enable Live Data Masking
  4. Click Save

​
Step 4: Test It

Run a query that returns sensitive data: 
SELECT name, email, phone FROM customers LIMIT 5;
You should see masked values in the results.

​
Supported Data Types

Live Data Masking detects these sensitive data types by default:

​
Personal Information

TypeExampleMasked As
Person NameJohn Smith[PERSON]
Email Addressjohn@example.com[EMAIL]
Phone Number555-123-4567[PHONE]
Physical Address123 Main St[ADDRESS]

​
Government IDs

TypeExampleMasked As
SSN (US)123-45-6789[SSN]
Passport NumberAB1234567[PASSPORT]
Driver’s LicenseD1234567[LICENSE]

​
Financial Data

TypeExampleMasked As
Credit Card4111-1111-1111-1111[CREDIT_CARD]
Bank Account123456789012[BANK_ACCOUNT]
IBANGB82WEST12345698765432[IBAN]

​
Credentials

TypeExampleMasked As
API Keysk_live_abc123…[API_KEY]
Passwordpassword123[PASSWORD]
AWS KeyAKIA…[AWS_KEY]

​
Health Information

TypeExampleMasked As
Medical RecordMRN-12345[MEDICAL_RECORD]
Health Plan IDHPL-98765[HEALTH_ID]

​
Configuration Options

​
DLP Mode

ModeBehavior
best-effortMask detected fields, continue if some fail
strictBlock the entire result if any masking fails
Recommendation: Start with best-effort to avoid blocking legitimate queries.

​
Custom Fields

Add or remove fields from detection. See Supported Fields for the complete list.

​
Per-Connection Settings

Enable or disable masking on individual connections:
  • Enable on production databases with real customer data
  • Disable on development databases with synthetic data

​
Use Cases

​
1. Developer Access to Production

Developers need to debug production issues but shouldn’t see customer PII:
  • Enable Live Data Masking on production connections
  • Developers can run diagnostic queries
  • Customer data is automatically protected

​
2. Analytics Without Exposure

Data analysts need aggregate insights but not individual records:
  • Masking protects individual-level PII
  • Aggregations (COUNT, SUM, AVG) work normally
  • Compliance requirements are met

​
3. Support Team Access

Support teams need to look up customer records:
  • Enable masking on support-facing connections
  • They can verify account status without seeing SSNs
  • Audit trail shows who accessed what

​
4. Third-Party Contractor Access

External contractors need database access:
  • Create a connection with masking enabled
  • Grant access to contractors
  • Sensitive data is never exposed

​
Troubleshooting

​
Data Not Being Masked

Check:
  1. Live Data Masking is enabled on the connection
  2. DLP provider is running and accessible
  3. Gateway environment variables are set correctly
  4. The data type is in the supported fields list
Test the DLP provider directly: 
curl -X POST http://presidio-analyzer:5001/analyze \
  -H "Content-Type: application/json" \
  -d '{"text": "John Smith, SSN 123-45-6789", "language": "en"}'

​
Too Much Data Being Masked

If legitimate data is being masked incorrectly:
  1. Check which field type is triggering
  2. Disable that specific field type in configuration
  3. Or use Guardrails for more precise control

​
Performance Impact

Live Data Masking adds latency to query results:
Result SizeTypical Latency
< 100 rows50-100ms
100-1000 rows100-500ms
> 1000 rows500ms+
To reduce latency:
  • Use LIMIT clauses in queries
  • Select only needed columns (avoid SELECT *)
  • Consider disabling masking for high-volume analytics

​
Compliance

Live Data Masking helps meet requirements for:
  • GDPR - Protect EU citizen personal data
  • HIPAA - Mask protected health information
  • PCI DSS - Redact credit card numbers
  • SOC 2 - Demonstrate data protection controls
  • CCPA - Protect California consumer data
Live Data Masking is one layer of a defense-in-depth strategy. Combine with Access Control and Guardrails for comprehensive protection.

​
Next Steps

Configuration Guide

Set up Microsoft Presidio or GCP DLP

Supported Fields

See all detectable data types

Guardrails

Block queries before they execute

Access Control

Control who can access connections