Dynamic Data Masking for Sensitive Data
Most data masking software hides values only in a query result or view, leaving the real value exposed underneath. Ubiq is database masking software that protects the underlying value itself, then decides at runtime whether each identity receives cleartext, a masked value, a tokenized value, or an encrypted value.
Trusted in production by security & data teams
Independently attested
SOC 2 Type II
PCI DSS SAQ-D
CMMC 2.0 Level 1What is dynamic data masking?
Dynamic data masking returns a different version of a sensitive value depending on who or what is requesting it, so the same field can show in cleartext to one identity and masked to another. Native database and warehouse masking usually controls what appears in a query result or application view. Ubiq goes further by protecting the underlying value itself, so masking becomes part of real data protection rather than only a presentation-layer filter.
Static and dynamic masking
Serve a permanently masked version where the original should never be exposed, such as dev, test, vendor, and analytics copies, or decide the outcome at runtime for production access.
Protect the value, not just the view
Sensitive values can stay encrypted, tokenized, or format-preserving at rest, so masking becomes real data protection instead of a presentation-layer filter over plaintext.
Identity-based reveal
The same protected value resolves to a full, partially masked, fully masked, tokenized, or protected value based on the requesting identity, application, service account, API, or workflow.
Traditional masking hides the value only where it is displayed, while the underlying value often stays in cleartext at rest.Comparing protected representations? See vaultless tokenization and format-preserving encryption.
Native masking hides what a user sees inside a specific system. Ubiq protects the underlying value itself, then returns the right protected or unprotected version at runtime based on identity, context, and policy.
Traditional and native masking tools change what a query, report, or application shows, while the real value may still remain in plaintext underneath. Ubiq protects the underlying value itself, then decides what version each identity, application, service account, API, or workflow receives at runtime.
Example
Stored value(in plaintext)
Returned to user(masked result)
The underlying value may still be stored in plaintext, where it can be exposed through compromised credentials, overprivileged users, DBA or admin access, service accounts, exports, replicas, logs, backups, or downstream copies.
Common challenges
- Sensitive values may remain exposed underneath
- Compromised credentials or insider access can still reveal the real data
- DBA, admin, and service-account access can bypass view-only controls
- Controls often live at the presentation or query layer
- Hard to enforce consistently across every application, workflow, export, and downstream copy
Example
Protected at rest(encrypted or tokenized)
Runtime outcome by identity
- Analyst555-12-1234
- Support•••-••-1234
- BI toolTOK-9F4B-D108
The underlying value stays protected, while each identity receives only the approved version.
Key benefits
- Protect sensitive values underneath
- Reveal the right version by identity and policy
- Enforce least privilege at the data value level
- Support full, masked, tokenized, or protected outcomes
What traditional dynamic data masking does not solve
Dynamic data masking limits who sees sensitive values in a query result or application view. But in most implementations the underlying value still sits in plaintext, and the control lives at the presentation layer. That leaves real exposure across the systems and identities that touch the data.
The real value stays in plaintext
Traditional masking changes the displayed result, but the original value often remains in cleartext at rest, available to anyone or anything that reaches it directly.
Masking does not eliminate credential or insider risk
If the original value remains in plaintext, masking only protects the approved query or application view. A compromised account, overprivileged user, malicious insider, DBA, admin, or service account may still be able to reach the underlying data directly.
Presentation-layer controls miss compromised and privileged access
Masking applied in an application or query view does not protect the underlying value from compromised credentials, malicious insiders, DBA or admin queries, service accounts, exports, replicas, logs, backups, or downstream copies.
Proxy-based masking changes the architecture
Many legacy masking tools sit between applications and databases as a proxy. That can require application or connection changes, introduce latency, add infrastructure to the data path, and force teams to rework how applications reach sensitive data.
One control rarely spans every consumer
Apps, APIs, service accounts, BI tools, notebooks, and AI workflows each reach the data differently, and consistent masking across all of them is hard to enforce.
Access is treated as all or nothing
Most masking decides only whether a value is shown or hidden, not which version each identity should receive based on role, context, and policy.
Ubiq reduces that blast radius by protecting the value itself and applies identity-governed policy at runtime through application, API, SDK, SQL UDF, and database and warehouse integration patterns.
How Ubiq works
Same sensitive data. Different identities. Different runtime outcomes.
Dynamic data masking protects the value. Ubiq evaluates the requesting identity, context, and policy at runtime, then returns only the masked, full, tokenized, or protected version that identity is authorized to see.
Access request
Protected employee record
- Employee ID
- EMP-3X9Q-1182
- Name
- Maria Chen
- maria@acme.com
- Salary
- $142,800
Real-time evaluation
Runtime data outcome
HR app
CleartextAuthorized to process the full employee record
Support analyst
MaskedNeeds to confirm the record, not read all fields
Analytics API
TokenizedAuthorized for analysis without exposing original identifiers
AI agent
MaskedReceives only the fields and detail needed for its task
Protected once. Resolved differently at runtime for each identity.
Where teams use dynamic data masking
Dynamic data masking lets the same sensitive field return different versions to different identities. These are the workflows where it matters most.
Customer support
Let support reps confirm a record with a masked value while fraud teams and approved workflows receive the full value, all from the same protected field.
Analytics and BI
Return masked or tokenized values to dashboards, reports, and notebooks so analysts work with production data without unrestricted access to raw sensitive fields.
Databases and data warehouses
Enforce field-level and column-level outcomes at runtime, so different users, queries, apps, and service accounts hitting the same table receive different versions.
Dev, test, and lower environments
Serve statically masked or tokenized data to development, QA, and vendor workflows without exposing the original regulated values.
Insider threat and overprivileged access
Reduce the blast radius of broad DBA, admin, and service-account access by controlling what sensitive fields each identity can actually reveal.
AI, RAG, and agents
Support AI and retrieval workflows on enterprise data while keeping sensitive source fields protected and governed by identity, limiting plaintext exposure across prompts, vector stores, and agents.
What to look for in data masking software
Data masking software should protect the underlying value, decide outcomes by identity at runtime, and apply consistently across your stack without a masking proxy in the data path or schema changes.
No masking proxy in the data path
Ubiq does not sit between your applications and databases as a proxy, so there is no new component to route sensitive traffic through and no proxy bottleneck to operate.
No database schema changes
Protect and reveal values without changing table schemas or rearchitecting how data is stored, where applicable.
No heavy rearchitecture
Integrate at applications, services, and API gateways without reworking how they reach sensitive data.
SDKs, APIs, SQL UDFs, and DB integrations
Deploy through a few lines of code, SQL UDFs, and native database and data warehouse integrations.
Works with your identity provider
Reuse your existing IAM so runtime decisions follow the identities you already manage.
Customer-managed keys
Bring your own HSM or KMS so key control stays with your team.
Masking vs tokenization: what is the difference?
Masking and tokenization are often compared because both help teams work with sensitive data without broadly exposing it. They solve different problems, and Ubiq governs them as runtime outcomes of one identity-aware policy model.That difference matters when sensitive data is copied, exported, materialized, joined, accessed by service accounts, or consumed outside the original warehouse query path. With Ubiq, the stored value can remain protected while policy determines whether each request receives cleartext, masked, tokenized, or encrypted data.
Data masking
Masking returns an obscured version of a value, such as showing only the last four digits of an account number. Many presentation-layer or dynamic masking approaches change what is displayed, while the underlying value may still remain available to the application, query, or system underneath.
- Controls what a given identity sees
- Often applied at the presentation, query, or access layer
- On its own, may leave the underlying value exposed
Tokenization
Tokenization replaces the sensitive value itself with a protected substitute value, so the stored value is protected rather than merely hidden from view. Authorized requests can still return the original cleartext value when policy allows. Ubiq uses vaultless tokenization, which avoids operating a central token vault or lookup store.
- Protects the stored value, not just the display
- Reversible for authorized requests
- Can preserve format so it fits existing systems
- Vaultless approaches avoid a central token vault or lookup dependency
With Ubiq, masking and tokenization are not separate tools to choose between. Ubiq protects the value itself, then uses identity-aware policy to return the configured runtime outcome for each identity, application, or workflow: cleartext, masked, tokenized, or encrypted.Same sensitive data. Different identities. Different runtime outcomes.
Frequently asked questions
What is dynamic data masking?
Dynamic data masking returns a different version of a sensitive value at runtime depending on who or what is requesting it. The same field can return the full value to one identity and a masked value to another, based on identity, context, and policy.
What is the difference between static and dynamic data masking?
Static data masking creates a permanently masked copy of the data for cases where the original should never be exposed, such as development, test, vendor, or analytics datasets. Dynamic data masking decides the outcome at runtime, so the same stored value can return different versions to different identities. Ubiq supports both patterns.
How is Ubiq different from traditional dynamic data masking?
Traditional dynamic data masking usually leaves the underlying value in plaintext and masks it only when it is displayed. Ubiq protects the value itself with encryption, tokenization, or format-preserving protection, then reveals the full, masked, tokenized, or protected version each identity is authorized to receive at runtime.
What runtime outcomes can Ubiq return for a masked field?
Based on identity and policy, Ubiq can return cleartext, a partially masked value, a fully masked value, a tokenized value, a format-preserving protected value, or an encrypted value. This enforces least privilege at the level of the data value, not just the system.
What should you look for in data masking software?
Most data masking tools only change what appears at the presentation layer and leave the real value in plaintext underneath. Look for software that protects the value itself with encryption, tokenization, or format-preserving protection, enforces outcomes consistently across applications, databases, warehouses, BI tools, and AI workflows, and decides what each identity receives at runtime based on policy. Ubiq is built around identity-governed runtime control rather than view-only masking.
Can Ubiq apply masking across databases, applications, and AI workflows?
Yes. Ubiq integrates through SDKs and APIs, SQL UDFs, and database and data warehouse integrations, so identity-governed masking applies consistently across applications, APIs, databases, warehouses, BI tools, and AI workflows.
Does Ubiq use format-preserving encryption for masking?
Where format compatibility matters, Ubiq can use format-preserving protection techniques so masked or protected values keep the structure that applications and databases expect. This is an implementation detail. The capability is identity-governed runtime control over what each identity can see and use.
Can teams use dynamic data masking for AI and RAG without exposing sensitive data?
Ubiq separates protection of sensitive source data from AI and vector computation. Sensitive records and identifiers stay protected and identity-governed, while AI and retrieval workflows operate on controlled derived representations. Identity and policy govern when source data is revealed, so teams reduce plaintext exposure across prompts, vector stores, and agents.
What is the difference between data masking and tokenization?
Data masking returns an obscured version of a value, such as showing only the last four digits, and in many implementations the underlying value still sits in cleartext. Tokenization replaces the sensitive value itself with a protected representation, so the stored value is protected rather than just hidden from view, and authorized requests can still recover the original value. With Ubiq you do not choose one or the other: Ubiq protects the value, then returns a cleartext, masked, tokenized, or encrypted version at runtime based on the requesting identity and policy. Ubiq's protection is reversible for authorized identities, not a one-way transformation.