> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Live Data Masking > Automatically detect and mask sensitive data in query results without writing rules export const DataMaskingDemo = () => { const FONTS_URL = "https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500&family=Inter:wght@400;500;600;700;800&display=swap"; const C = { espresso: "var(--gradient-dark-mid)", warmGold: "var(--warm-gold)", sand100: "var(--sand-100)", sand300: "var(--sand-300)", sand500: "var(--sand-500)" }; const QUERY = "SELECT name, email, ssn, card FROM customers LIMIT 4;"; const TYPING_CHAR_MS = 22; const ROWS = [{ raw: ["Sarah Chen", "sarah.chen@acme.io", "284-19-7653", "4532-8821"], masked: ["[PERSON]", "[EMAIL]", "[SSN]", "[PCI]"] }, { raw: ["Marcus Webb", "m.webb@globex.com", "531-77-0294", "4916-3350"], masked: ["[PERSON]", "[EMAIL]", "[SSN]", "[PCI]"] }, { raw: ["Elena Ruiz", "eruiz@initech.co", "719-42-8106", "5425-1247"], masked: ["[PERSON]", "[EMAIL]", "[SSN]", "[PCI]"] }, { raw: ["James Okafor", "j.okafor@stark.dev", "603-88-1542", "4111-9063"], masked: ["[PERSON]", "[EMAIL]", "[SSN]", "[PCI]"] }]; const ROW_DELAY = 800; const CROSS_DURATION = 600; const HOLD = 3000; function ShieldIcon({active, done}) { return {done && } ; } const [typedLen, setTypedLen] = useState(0); const [typingDone, setTypingDone] = useState(false); const [rowPhases, setRowPhases] = useState(ROWS.map(() => "hidden")); const [allDone, setAllDone] = useState(false); const [membraneActive, setMembraneActive] = useState(false); const [membraneGlow, setMembraneGlow] = useState(false); const timeouts = useRef([]); const frameRef = useRef(null); const clearAll = useCallback(() => { timeouts.current.forEach(clearTimeout); timeouts.current = []; if (frameRef.current) cancelAnimationFrame(frameRef.current); }, []); const later = useCallback((fn, ms) => { const id = setTimeout(fn, ms); timeouts.current.push(id); }, []); useEffect(() => { let cancelled = false; const cycle = () => { if (cancelled) return; setTypedLen(0); setTypingDone(false); setRowPhases(ROWS.map(() => "hidden")); setAllDone(false); setMembraneActive(false); setMembraneGlow(false); const typingStart = performance.now(); function tick(now) { if (cancelled) return; const elapsed = now - typingStart; const chars = Math.min(Math.floor(elapsed / TYPING_CHAR_MS), QUERY.length); setTypedLen(chars); if (chars < QUERY.length) { frameRef.current = requestAnimationFrame(tick); } else { setTypingDone(true); } } frameRef.current = requestAnimationFrame(tick); const typingTotal = QUERY.length * TYPING_CHAR_MS; const baseDelay = typingTotal + 400; later(() => { if (cancelled) return; setMembraneActive(true); }, baseDelay); ROWS.forEach((_, i) => { const t0 = baseDelay + 300 + i * ROW_DELAY; later(() => { if (cancelled) return; setRowPhases(p => { const n = [...p]; n[i] = "approaching"; return n; }); }, t0); later(() => { if (cancelled) return; setRowPhases(p => { const n = [...p]; n[i] = "crossing"; return n; }); setMembraneGlow(true); later(() => { if (!cancelled) setMembraneGlow(false); }, 300); }, t0 + 400); later(() => { if (cancelled) return; setRowPhases(p => { const n = [...p]; n[i] = "through"; return n; }); }, t0 + 400 + CROSS_DURATION); }); const total = baseDelay + 300 + (ROWS.length - 1) * ROW_DELAY + 400 + CROSS_DURATION + 300; later(() => { if (!cancelled) setAllDone(true); }, total); later(() => { if (!cancelled) cycle(); }, total + HOLD); }; cycle(); return () => { cancelled = true; clearAll(); }; }, [later, clearAll]); return <>
{}
{}
Claude Code Gateway {allDone ? "Protected" : membraneActive ? "Active" : "Ready"}
{}
claude $ {QUERY.slice(0, typedLen)} {!typingDone && |}
{}
{}
Claude Code query
{ROWS.map((row, i) => { const phase = rowPhases[i]; const show = phase === "approaching" || phase === "crossing"; return
{row.raw[0]} , {row.raw[1]}
{row.raw[2]} , {row.raw[3]}
; })}
{}
{}
{}
Delivered to Claude
{ROWS.map((row, i) => { const phase = rowPhases[i]; const show = phase === "through"; return
{row.masked.slice(0, 2).map((m, j) => {m})}
{row.masked.slice(2).map((m, j) => {m})}
; })}
{}
{["Zero-config proxy", "GDPR", "PCI-DSS", "Real-time"].map(tag => {tag})}
; };
## What You'll Accomplish Live Data Masking automatically detects and redacts sensitive data in your query results. Unlike traditional DLP solutions that require complex rule configuration, Hoop's data masking works out of the box: * Automatically detect PII (names, emails, phone numbers, SSNs) * Mask credit card numbers and financial data * Redact passwords, API keys, and secrets * Protect health information (HIPAA compliance) * No regex patterns to write or maintain *** ## How It Works Live Data Masking operates at the protocol layer. When someone queries a resource role that has masking enabled, hoop.dev intercepts the response as it streams back, sends the content to your configured DLP provider for inspection, and redacts any sensitive values before the results reach the user. This happens **in memory and in real time** — the original data is never stored or exposed. A user runs a query or command through hoop.dev hoop.dev intercepts the result stream at the protocol layer The configured DLP provider scans the content for sensitive data Sensitive values are redacted in memory; the user sees masked results ### Before and After **Original query result:** ``` | name | email | ssn | phone | |--------------|--------------------| ------------|--------------| | John Smith | john@example.com | 123-45-6789 | 555-123-4567 | | Jane Doe | jane@company.org | 987-65-4321 | 555-987-6543 | ``` **With Live Data Masking enabled:** ``` | name | email | ssn | phone | |--------------|--------------------| ------------|--------------| | [REDACTED] | [REDACTED] | [REDACTED] | [REDACTED] | | [REDACTED] | [REDACTED] | [REDACTED] | [REDACTED] | ``` *** ## Supported Data Types Live Data Masking relies on your DLP provider's detection engine to recognize a wide range of sensitive data out of the box, grouped into categories such as: * **Personal information** — names, email addresses, phone numbers, physical addresses * **Government & national IDs** — SSNs, passport numbers, driver's licenses * **Financial data** — credit card numbers, bank accounts, IBANs * **Credentials & secrets** — API keys, passwords, access keys * **Health information** — medical record numbers, health plan IDs A default set of the most common fields is enabled automatically, and you can add or remove fields per resource role. For the complete, provider-specific catalog, see the [full list of supported fields](/setup/configuration/live-data-masking/fields). *** ## Use Cases ### 1. Developer Access to Production Developers need to debug production issues but shouldn't see customer PII: * Enable Live Data Masking on production resource roles * Developers can run diagnostic queries * Customer data is automatically protected ### 2. Analytics Without Exposure Data analysts need aggregate insights but not individual records: * Masking protects individual-level PII * Aggregations (COUNT, SUM, AVG) work normally * Compliance requirements are met ### 3. Support Team Access Support teams need to look up customer records: * Enable masking on support-facing resource roles * They can verify account status without seeing SSNs * Audit trail shows who accessed what ### 4. Third-Party Contractor Access External contractors need database access: * Create a resource role with masking enabled * Grant access to contractors * Sensitive data is never exposed *** ## Compliance Live Data Masking helps meet requirements for: * **GDPR** - Protect EU citizen personal data * **HIPAA** - Mask protected health information * **PCI DSS** - Redact credit card numbers * **SOC 2** - Demonstrate data protection controls * **CCPA** - Protect California consumer data Live Data Masking is one layer of a defense-in-depth strategy. Combine with [Access Control](/learn/features/access-control) and [Guardrails](/learn/features/guardrails) for comprehensive protection. *** Ready to turn it on? The [Live Data Masking configuration guide](/setup/configuration/live-data-masking/get-started) walks through setting up a DLP provider, choosing a redact mode, and enabling masking on your resource roles. ## Next Steps Set up Microsoft Presidio or GCP DLP See all detectable data types Block queries before they execute Control who can access resource roles