Get Started

Prerequisites

Have properly installed hoop.dev through one of the options available in the deployment overview
Be on an enterprise plan
Enough access to your infrastructure so you can load environment variables to your hoop.dev instance
Have admin access to your hoop.dev instance

This page is dedicated to the setup of Live Data Masking in self-hosted instances. If you are looking for the Learn Guides of Live Data Masking, click here.

Setup

This service supports two providers for data classification and PII detection: Alcatraz, which runs inside the agent and needs no extra services, and Microsoft Presidio, which you deploy and point the gateway at. Google Cloud Data Loss Prevention (DLP) is still available for existing customers but is deprecated for new installations.

You must be on an Enterprise plan to have full access to the Live Data Masking feature.

Alcatraz

Alcatraz detects sensitive data in-process, inside the agent. There is no analyzer to deploy, no anonymizer, no credentials and no network hop: detection is a function call on the data already passing through the agent.

Set up

Set the environment variables in hoop.dev’s Gateway:

Environment variable key	Value	Required
`DLP_PROVIDER`	alcatraz	Yes
`DLP_MODE`	`best-effort` or `strict`	No, defaults to `best-effort`

No analyzer URL, no anonymizer URL and no service account: unlike the other two providers, Alcatraz has nothing external to reach.

Run hoop.dev's Gateway with the new configs

Masking rules apply to every resource role you activate, and the entity types you pick per rule are evaluated by the agent serving the session.

Deploy an agent that can serve the statistical entity types

Only needed if your masking rules select PERSON, LOCATION or NRP — see below. Every other entity type works on any agent image.

PERSON, LOCATION and NRP need a model on the agent

Most entity types are pattern-based: credit cards, IBANs, national IDs, API keys and the rest are matched, checksum-verified where a checksum exists, and masked without anything extra on disk. Names, places and nationalities cannot be matched that way — they come from a statistical NER model that runs in-process on the agent. The agent never downloads that model at runtime. Either its image carries it, or you mount it:

Agent image	What to do
`hoophq/hoopagent:<version>-minimal-alcatraz`	Nothing — the model ships in the image, which sets `ALCATRAZ_NER_MODEL_PATH` itself
`hoophq/hoopagent:<version>-distroless-alcatraz`	Nothing — same, on the distroless base
`hoophq/hoopdev`, or any other image	Mount the model directory and set `ALCATRAZ_NER_MODEL_PATH` to it

For the mounted case, ALCATRAZ_NER_MODEL_PATH is the models directory — the parent that holds one subdirectory per model id, which is what alcatraz models download --dest <dir> writes into.

An agent with no model on disk refuses sessions whose masking rules ask for PERSON, LOCATION or NRP. It does not return that data unmasked. Rules using any other entity type keep working on the same agent.

The model loads lazily, on the first session that needs one of those three types, and then holds about 260MB of resident memory until the agent restarts. Give the agent pod headroom before you enable those entity types.

Alcatraz deployment

Provisioning the model, sizing, verification and troubleshooting.

Container images

The tag list and what each flavour contains.

Microsoft Presidio

Install

Check the Microsoft Presidio documentation to install it.

Microsoft Presidio Docker Installation

Visit the Microsoft Presidio documentation to install it using Docker.

Microsoft Presidio Kubernetes Installation

Visit the Microsoft Presidio documentation to install it using Kubernetes.

Set up

Set the new environment variables in hoop.dev’s Gateway with the following values:

Environment variable key	Value
`DLP_PROVIDER`	mspresidio
`DLP_MODE`	`best-effort` or `strict`
`MSPRESIDIO_ANALYZER_URL`	`<host-to-analyzer:port>`
`MSPRESIDIO_ANONYMIZER_URL`	`<host-to-anonymizer:port>`

Run hoop.dev's Gateway with the new configs

After setting up the environment variables, hoop.dev will use Microsoft Presidio to mask sensitive data in real-time in the data stream of any resource role you configure.

Google Cloud Data Loss Prevention (DLP)

Create an account at Google Cloud Data Loss Prevention and a service account with the permission roles/dlp.user. When installing hoop.dev, you need to set the environment variable GOOGLE_APPLICATION_CREDENTIALS_JSON with your GCP DLP credentials in hoop’s Gateway. Hoop.dev uses Google Cloud’s DLP at our protocol layer to mask sensitive data in real-time in the data stream of any resource role you configure.

Google Cloud Data Loss Prevention (DLP) is still available for existing customers but is deprecated for new installations.

Redact Modes

The gateway now supports two operational modes that control how redaction failures are handled. Configure your preferred mode by setting the environment variable DLP_MODE to either strict or best-effort.

best-effort

This is the default mode, it will redact the content, however if it find any error it will continue to operate without any disruption.

DLP_MODE=best-effort

strict

This mode will return an error in case it find any redaction issue

DLP_MODE=strict

Start with best-effort to avoid blocking legitimate queries while you tune which fields are masked, then move to strict once detection is dialed in.

Activate on your resource roles

In the Web App, open the Discover section in the main sidebar and select AI Data Masking. From there, activate masking on each resource role you want to protect, and use the Configure button to choose which fields are masked. A set of default, most-used fields is enabled automatically, so masking works as soon as you activate a resource role. You can add or remove fields at any time.

Detected data types

Once activated, Live Data Masking detects a wide range of sensitive data out of the box, grouped into the categories below.

Personal Information

Type	Example	Masked As
Person Name	John Smith	[PERSON]
Email Address	john@example.com	[EMAIL]
Phone Number	555-123-4567	[PHONE]
Physical Address	123 Main St	[ADDRESS]

Government IDs

Type	Example	Masked As
SSN (US)	123-45-6789	[SSN]
Passport Number	AB1234567	[PASSPORT]
Driver’s License	D1234567	[LICENSE]

Financial Data

Type	Example	Masked As
Credit Card	4111-1111-1111-1111	[CREDIT_CARD]
Bank Account	123456789012	[BANK_ACCOUNT]
IBAN	GB82WEST12345698765432	[IBAN]

Credentials

Type	Example	Masked As
API Key	sk_live_abc123…	[API_KEY]
Password	password123	[PASSWORD]
AWS Key	AKIA…	[AWS_KEY]

Health Information

Type	Example	Masked As
Medical Record	MRN-12345	[MEDICAL_RECORD]
Health Plan ID	HPL-98765	[HEALTH_ID]

For the complete, provider-specific list, see Supported Fields.

Troubleshooting

Data Not Being Masked

Check:

Live Data Masking is enabled on the resource role
DLP provider is running and accessible
Gateway environment variables are set correctly
The data type is in the supported fields list

Test the DLP provider directly:

curl -X POST http://presidio-analyzer:5001/analyze \
  -H "Content-Type: application/json" \
  -d '{"text": "John Smith, SSN 123-45-6789", "language": "en"}'

Too Much Data Being Masked

If legitimate data is being masked incorrectly:

Check which field type is triggering
Disable that specific field type in configuration
Or use Guardrails for more precise control

Performance Impact

Live Data Masking adds latency to query results:

Result Size	Typical Latency
< 100 rows	50-100ms
100-1000 rows	100-500ms
> 1000 rows	500ms+

To reduce latency:

Use LIMIT clauses in queries
Select only needed columns (avoid SELECT *)
Consider disabling masking for high-volume analytics

How it works

At the protocol layer when communicating with a database or server, hoop.dev will open the package and communicate with DLP provider to mask sensitive data in it. This happens in memory and in real-time, so the data is never stored in the database or server in its original form. After the setup, we automatically give you a bunch of default and most used fields, so you don’t need to worry much about that part either. You can remove or add fields as much as you like. To see all fields available, check our documentation page for all fields supported.

Overview

Features

Clients

Quickstart

Setup & Administration

Concepts

Integrations

Prerequisites

Setup

Alcatraz

PERSON, LOCATION and NRP need a model on the agent

Alcatraz deployment

Container images

Microsoft Presidio

Microsoft Presidio Docker Installation

Microsoft Presidio Kubernetes Installation

Google Cloud Data Loss Prevention (DLP)

Redact Modes

best-effort

strict

Activate on your resource roles

Detected data types

Personal Information

Government IDs

Financial Data

Credentials

Health Information

Troubleshooting

Data Not Being Masked

Too Much Data Being Masked

Performance Impact

How it works

​Prerequisites

​Setup

​Alcatraz

​PERSON, LOCATION and NRP need a model on the agent

Alcatraz deployment

Container images

​Microsoft Presidio

Microsoft Presidio Docker Installation

Microsoft Presidio Kubernetes Installation

​Google Cloud Data Loss Prevention (DLP)

​Redact Modes

​best-effort

​strict

​Activate on your resource roles

​Detected data types

​Personal Information

​Government IDs

​Financial Data

​Credentials

​Health Information

​Troubleshooting

​Data Not Being Masked

​Too Much Data Being Masked

​Performance Impact

​How it works

Prerequisites

Setup

Alcatraz

PERSON, LOCATION and NRP need a model on the agent

Microsoft Presidio

Google Cloud Data Loss Prevention (DLP)

Redact Modes

best-effort

strict

Activate on your resource roles

Detected data types

Personal Information

Government IDs

Financial Data

Credentials

Health Information

Troubleshooting

Data Not Being Masked

Too Much Data Being Masked

Performance Impact

How it works