Data Masking

Data masking alters what a query returns for a connected column, based on the querying user’s role — the value stored in the data source itself doesn’t change. Data masking is one of Data Access Controls’ policy types; unlike Advanced Data Protection’s tokenization and Format-Preserving Encryption features, which replace or encrypt the stored value, data masking only changes what’s returned in query results.

In this section

• Masking Types — ALTR’s 10 masking types and how ALTR resolves overlapping policies.
• Tag-Based Masking — Apply masking rules to every column carrying a matching tag.
• Column-Based Masking — Apply masking rules to one individually named column.
• Policy Alerts — Log or block access when a masking policy’s access-rate or time-window rule is violated.

Masking Type

When a masked column is queried, ALTR evaluates the policies that apply to that column for the querying role and returns a masking type: the concrete behavior ALTR applies to the value, such as returning it in full, masking part of it, or returning a fixed placeholder. See Masking Types for the full list of masking types and how ALTR resolves overlapping policies.

Roles come from the data source — normally the querying user’s data-source role. On Snowflake, ALTR evaluates against ALTR user groups, which usually but not always map 1:1 to the Snowflake role; the mapping is customizable via the ALTR_ROLE_SET custom role-extension function. Data Masking on Snowflake covers the full role-mapping mechanism.

Default-Deny Behavior

A role that isn’t listed in any of a masking policy’s rules receives a NULL value, not the original value, for any column the policy covers. Confirm that every role that should see the data is included in a rule; an omitted role is denied by default rather than granted access.

Create a Masking Policy

A masking policy applies to either a Snowflake Object Tag or Databricks Unity Catalog Tag, or a single named column. A tag or column must be connected to ALTR before it can be masked; Data Masking on Snowflake covers how to connect one.

To create a masking policy:

1. Select Policy in the navigation menu.
2. Click Create Policy.
3. Locate the Tag Policy or Column Policy card and click Create Policy.
4. Continue with the Tag-Based Masking or Column-Based Masking procedure for the remaining steps.

Note

OLTP data sources don’t have masking. Access to OLTP databases is controlled by allowing or blocking queries at the sidecar, not by masking values. See Access Management Policy for OLTP access control.

Note

Masking behavior specific to a data source, including the protection-type options available when you connect a tag or column, is described in Data Masking on Snowflake and Data Masking on Databricks.