Teams need realistic data for development and testing, but production data can create security and compliance risks in non-production environments. Masking replaces sensitive information with safer, usable alternatives.
Perforce Delphix Continuous Compliance supports masking alongside data virtualization and data management.
This guide covers how Delphix data masking works, its capabilities, use cases, and best practices within a broader test data management (TDM) strategy.
What Is Delphix Data Masking?
Delphix data masking identifies sensitive information and replaces it with realistic, fictitious data that teams can safely use outside production. Delphix offers this capability through Continuous Compliance for development, testing, analytics, AI, and other non-production use cases.
For example, Delphix can replace names, email addresses, payment information, and other PII while keeping the characteristics applications and tests need.
Delphix primarily uses static, or persistent, masking, which irreversibly transforms stored data instead of hiding values only at query time. Delphix also supports tokenization for reversible protection, unlike masking, which permanently anonymizes the original information.
How Does Delphix Data Masking Work?
Delphix masking identifies sensitive data, applies masking rules, transforms values, and delivers safer data for non-production use. Here’s how the Delphix data masking process works from start to finish:
1. Define Compliance Policies
Delphix policies control what gets masked and how across applications, clouds, and locations, with auditing and reporting for governance and compliance.
2. Discover Sensitive Data
Delphix automatically discovers PII and PHI such as names, addresses, Social Security numbers, and payment information.
Its profiling tools examine column names and actual values, associate sensitive data with domains, and recommend masking algorithms. Teams can also create custom classifiers.
3. Assign Masking Algorithms
Delphix offers predefined and configurable algorithms for character replacement, date shifting, synthetic values, tokenization, and lookup substitutions.
The technique depends on the data: dates may need to remain valid, while names may need realistic replacements.
4. Execute the Masking Process
The job applies configured algorithms to selected fields. Delphix APIs also let teams automate masking within data workflows.
5. Preserve Data Relationships
Masking also needs to preserve relationships between tables, databases, and applications. For example, replacing the same customer ID differently across connected systems could break integration tests.
Delphix uses consistent masking to preserve referential integrity across connected data sources and environments.
6. Deliver Compliant Data
After masking, teams can make protected data available to authorized users.
Continuous Compliance can integrate with Delphix Continuous Data to deliver virtualized masked datasets without maintaining as many full physical copies.
Key Delphix Data Masking Capabilities
Delphix combines masking with discovery, policy management, automation, and data delivery to protect sensitive information across applications and data sources.
1. Sensitive Data Discovery and Profiling
Delphix discovers sensitive information across databases, data warehouses, files, and other enterprise sources, then associates sensitive fields with masking domains and algorithms.
2. Configurable Masking Algorithms
Delphix offers built-in and customizable algorithms, including character mapping, date shifting, lookup substitutions, tokenization, and synthetic data generation.
Masked values can preserve the formats and characteristics applications need to work correctly.
3. Referential Integrity
Delphix masks matching values consistently across systems to preserve important data relationships.
4. Centralized Compliance Policies
Separate masking rules across many applications and environments can quickly become inconsistent.
Delphix lets teams centrally define and enforce compliance policies across environments.
5. Automation
Delphix provides APIs and UI-based tools for building masking into repeatable workflows.
Teams can incorporate masking into test data provisioning, DevOps, and CI/CD processes.
How to Implement Delphix Data Masking
Implementation varies by environment, but most teams follow these steps.
1. Identify Sensitive Data
Identify sensitive information and where it lives, including PII, PHI, payment, employee, and financial data.
Check databases, warehouses, files, applications, and connected systems. Delphix can automate discovery, but teams must still account for regulatory requirements.
2. Classify Data and Define Masking Requirements
Classify data by type, compliance requirements, and application use, then decide what requires irreversible masking.
Preserve required formats, ranges, and consistent identifiers.
3. Select Masking Algorithms
Choose a predefined or configurable Delphix algorithm based on the data type and how teams will use the masked data.
4. Configure Rules and Policies
Centralize rules across environments and update them as applications change.
5. Execute Masking Jobs
Run the job against the target dataset. Delphix Data Control Tower can mask selected database columns and files.
6. Validate Security and Data Quality
Verify that sensitive data can’t be recovered and the result still supports realistic testing.
7. Integrate Masking Into Test Data Workflows
Make masking part of routine non-production provisioning and refreshes.
Automate refreshes so data is protected before non-production users access it.
Delphix Data Masking Use Cases
Delphix data masking supports development, testing, QA, UAT, analytics, AI, and data migration workflows.
Teams can work with realistic datasets without exposing production PII or other confidential records, including when copying data between environments.
Continuous Compliance supports these use cases across databases, data warehouses, files, and private, public, hybrid, and multicloud environments.
Delphix Data Masking Best Practices
A masking platform alone doesn’t make test data secure. Teams also need consistent discovery, validation, automation, and governance.
1. Discover Sensitive Data Before Building Masking Rules
Applications, schemas, and integrations change over time, creating new copies of sensitive data.
Use profiling and discovery before assigning policies, and repeat the process regularly to catch new sensitive fields.
2. Preserve Referential Integrity
Protect sensitive information without breaking the relationships that make test data useful.
Apply consistent transformations wherever the same values appear across tables, databases, applications, and integrations.
3. Use Consistent Masking Across Connected Systems
Customer information may appear across CRM platforms, billing systems, data warehouses, analytics tools, and other applications.
Use centralized policies and deterministic transformations to protect it consistently across connected systems.
4. Preserve Data Realism and Format
Preserve the formats, constraints, and business rules applications expect so masked data remains useful for testing.
5. Automate Masking as Part of Data Refreshes
Build masking into non-production data provisioning to improve consistency and reduce the risk of releasing unmasked data.
6. Validate Every Masking Cycle
Confirm that sensitive fields were transformed, relationships remain intact, and applications still behave as expected.
7. Maintain Auditability
Keep records of policies, execution history, changes, and results to demonstrate how sensitive information is protected.
Delphix supports centralized policy enforcement, auditing, and reporting for governance and compliance.
8. Review Masking Policies as Applications Change
Review discovery results and masking rules as releases introduce new tables, columns, files, and integrations.
Common Delphix Data Masking Challenges
Even with dedicated tools, enterprise data masking can get complicated. These common challenges can affect security and usability.
1. Managing Complex Data Relationships
Enterprise applications often rely on relationships across hundreds or thousands of tables.
Masking without accounting for these dependencies can produce secure but unusable test data, so rules need to preserve important relationships.
2. Masking Data Across Multiple Systems
Sensitive data can spread across databases, files, data warehouses, reporting systems, and downstream integrations.
Centralized policies and automation help keep masking consistent as the data landscape grows.
3. Maintaining Realistic Test Data
Mask too little and sensitive information remains exposed; mask too aggressively and the data may no longer support realistic testing.
4. Handling Large Data Volumes
Large datasets can make masking performance and timing harder to manage.
Consider when masking runs, refresh frequency, and delivery timelines. Delphix offers Hyperscale Compliance for large-scale masking requirements.
5. Keeping Masking Rules Current
Schemas change, applications get upgraded, and new integrations introduce sensitive fields.
Regular discovery and governance help keep masking rules current.
Delphix Data Masking vs. Enov8
Delphix isn’t the only option for protecting production data in non-production environments.
Enov8 combines data masking with test data management, environment management, and automation, making masking part of the larger process of provisioning, refreshing, securing, and managing test environments.
When comparing Delphix and Enov8, also consider data discovery, referential integrity, automation, provisioning, environment refreshes, governance, and integration with existing workflows.
The right choice depends on your technology, data landscape, and goals. Enov8 may suit teams that want masking as part of a broader test data and environment management strategy.
Building Data Masking Into a Broader Test Data Management Strategy
Data masking makes sensitive data safer outside production, but it’s only one part of test data management.
Teams also need to manage where test data comes from, who can access it, where it goes, and how often it gets refreshed.
A mature TDM strategy brings discovery, classification, masking, provisioning, validation, governance, and environment management into one repeatable workflow.
Enov8 combine test data management with environment and release management to help teams protect data and improve how they provision, refresh, and manage non-production environments.
Key Takeaways
Delphix data masking helps organizations protect sensitive information while keeping data realistic and useful for development, testing, analytics, and AI. But effective masking goes beyond transforming data. It requires ongoing discovery, validation, automation, and governance to keep non-production data secure and usable.
As test data environments grow more complex, organizations can benefit from treating masking as part of a broader test data management strategy. For teams looking to bring these processes together, Enov8 offers an integrated approach to test data provisioning, masking, and environment management.
