At a glance
| Supported databases | Oracle, SQL Server, PostgreSQL, MySQL, MariaDB, MongoDB, Cassandra, Db2, Informix, SAP ASE, SAP HANA, Snowflake, AWS and Azure data stores, Databricks |
| Auditing and activity monitoring | Not an activity monitoring product |
| Masking | Static, irreversible, deterministic masking |
| Encryption or tokenization | Not documented as a feature (masking is one-way) |
| Privileged access | Not applicable |
| Policy enforcement | YAML masking rulesets |
| Compliance reporting | Not documented on the pages checked |
| Deployment | Self-managed (Linux, containers, EKS, ECS, OpenShift, Cohesity) or marketplace On Demand |
| Licensing | Per deployment by quote; On Demand from $49 per hour |
DataMasque is a focused choice for teams that need masked, non-production copies of Oracle, SQL Server, PostgreSQL, MySQL, MongoDB, Snowflake or AWS data stores, with foreign keys kept consistent across systems. It masks data, it does not clone or virtualise databases, so pair it with your own copy process or a cloning tool. Pricing is per deployment by quote, or from $49 per hour on the marketplaces.
Overview
DataMasque replaces sensitive production values with realistic substitutes as data leaves production, so test and development copies hold no real customer data. Masking is irreversible; the vendor documents salted SHA-512 hashing for deterministic results, which keeps primary keys, unique keys and foreign-key relationships consistent across databases, files and cloud stores. Masking rules are defined in YAML ruleset files, and a sensitive data discovery feature finds candidate columns by metadata keywords and in-data patterns.
The support matrix covers Oracle (11gR2 to 26ai), SQL Server (2012 to 2025), PostgreSQL (9.6 to 18), MySQL, MariaDB, MongoDB, Cassandra, Db2 LUW and Db2 for i, Informix, SAP ASE and SAP HANA, plus Snowflake, Aurora, RDS, Redshift, DynamoDB, DocumentDB, Cosmos DB and Databricks. It also masks files (CSV, fixed width, Parquet, JSON, XML, Avro, NDJSON) on S3, Azure Blob, Google Cloud Storage, NFS and SMB. You run it yourself on Linux, Docker, Podman, EKS, ECS, OpenShift on AWS or Cohesity, or buy On Demand through the AWS or Azure marketplaces.
Key features
- Irreversible static masking with deterministic, salted SHA-512 based replacement
- Consistent masking of primary, unique and foreign keys across databases and files
- Sensitive data discovery using metadata keywords, built-in and custom patterns and in-data patterns
- File masking for CSV, fixed width, Parquet, JSON, XML, Avro and NDJSON on S3, Azure Blob, GCS, NFS and SMB
- YAML rulesets and an API-first design for CI/CD pipelines
- Self-managed on Linux, Docker, Podman, EKS, ECS or OpenShift, or On Demand through cloud marketplaces
Integrations and ecosystem
Pros and cons
Pros
- Broad support matrix with explicit database versions, including Oracle 26ai and SQL Server 2025
- Consistent keys across databases and files, so masked systems still join
- Masks files and NoSQL stores as well as relational databases
- Published starting price for the marketplace On Demand edition
Cons
- Masking only: no subsetting or virtual database copies documented
- Main licences are quote-only
- Irreversible by design, so it does not suit cases that need re-identification
Pricing
DataMasque licenses per deployment, with the licence depending on data types, number of applications and where the data is housed; these quotes are tailored. DataMasque On Demand, sold through AWS Marketplace and Azure Marketplace for individual users and smaller datasets, uses consumption pricing that the pricing page says starts at $49 per hour (currency not stated, presumably USD). No free trial is mentioned on the pricing page.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Teams that need irreversibly masked copies of production databases and files for test, development or analytics, across several engines.
Typical use cases
- Mask a production Oracle or SQL Server copy before handing it to a test team
- Keep customer IDs consistent across masked PostgreSQL, MongoDB and Parquet files
- Mask data in a Snowflake or Redshift copy for analytics outside production
- Run masking as a CI/CD step after each database refresh
Who should look elsewhere
- Teams that also need virtual database copies, refresh and rewind: see Perforce Delphix.
- Teams that need reversible tokenization in production: see Protegrity.
Verdict
DataMasque is a capable, focused static masking tool with a wide, version-specific support matrix and consistent masking across databases and files. It leaves cloning, subsetting and provisioning to other tools, so it fits teams that already have a copy process and want the masking step done well.
Frequently asked questions
Is DataMasque masking reversible?
No. DataMasque describes its masking as irreversible, using salted SHA-512 hashing so the same input always gives the same output and keys stay consistent, but originals cannot be recovered.
Which databases does DataMasque support?
Its support matrix lists Oracle, SQL Server, PostgreSQL, MySQL, MariaDB, MongoDB, Cassandra, Db2 LUW and Db2 for i, Informix, SAP ASE and SAP HANA with versions, plus Snowflake, Aurora, RDS, Redshift, DynamoDB, DocumentDB, Azure Cosmos DB, Azure SQL and Databricks.
How much does DataMasque cost?
Standard licences are per deployment and quoted. DataMasque On Demand on AWS and Azure Marketplace uses consumption pricing starting at $49 per hour, according to the pricing page.
Sources
- DataMasque website
- DataMasque pricing
- DataMasque supported data sources
- DataMasque documentation (installation options)
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.