Use case · Dev and test

Mask the documents, not just the database

Most test data programmes mask the tables and stop. The PDFs, notes, emails and attachments stored beside them get copied into dev and test untouched, and that's where the real names still are.

Refresh #214 · prod → UATIllustration
SourceIn UATTime
TABLECustomer and account tablesMasked6m 12s
TEXTNotes and comment columnsMasked in the text3m 40s
PDFPDFs stored in BLOB columnsMasked9m 05s
FILESAttachments on file sharesMasked7m 18s
LOGSMessage queues and API logsMasked2m 51s
CHECKLabelled-sample checkPassed1m 30s
No source carries real personal data into UAT. Same policy as the tables, logged for every run.
Refresh #214 · prod → UATIllustration
SourceIn UATTime
TABLECustomer and account tablesMasked6m 12s
TEXTNotes and comment columnsCopied as is–
PDFPDFs stored in BLOB columnsCopied as is–
FILESAttachments on file sharesCopied as is–
LOGSMessage queues and API logsCopied as is–
CHECKLabelled-sample checkNot run–
4 of 5 sources carry real personal data into UAT.
Illustration. Test copies are made often, shared widely and watched less than production. Everything that rides along with the database inherits that exposure.

What table masking leaves behind

Notes columns
Free text in CRM, claims and case systems, where agents typed names, phone numbers and diagnoses.
Stored documents
PDFs and scans in BLOB columns, object storage and file shares, referenced by the rows you just masked.
Messages and payloads
XML and JSON in queues, integration logs and audit tables, often copied along with the database.

How it works

1Find it allScan the tables and the files next to them, so the plan covers every place personal data sits.
2Mask the tablesConsistent replacements keep keys, joins and test cases working across systems.
3Mask the filesDocuments and text in the same refresh, with names and numbers replaced rather than blacked out.
4Refresh on a scheduleRun it as part of the pipeline so every new copy is masked the same way.

Same person, same replacement

If the letter says Maria Lopez, every document in the run that mentions her should say Jordan Hale afterwards, or testers chase mismatches that aren't bugs.

customers · row 10293
name: Maria Lopez Jordan Hale
letters/10293_claim_ack.pdf · page 1
Dear Maria Lopez Jordan Hale, we have received your claim…

Check before the next refresh

  • Which columns hold files or long text (BLOB, CLOB, TEXT, JSON).
  • Which buckets and file shares the application reads from in test.
  • Whether ticket and email attachments are copied with the data.
  • Whether logs and message queues come across from production.
  • For each, decide: mask, replace with synthetic, or leave out.

What's covered

Database tablesAvailable
Synthetic CSV sets, keys kept across filesAvailable
PDF, DOCX and PPTX filesEngineer-led
Notes columns, masked in the textEngineer-led

Questions

Why not just leave documents out of test copies?

Sometimes that's the right call. But any test that opens, renders or reads a document then fails, and teams tend to copy real files back in to get unblocked. Masked or synthetic files keep those tests working.

Will masked PDFs still work in our application?

Yes. They keep their pages and layout. If your tests select or search text inside the PDF, choose searchable output: the text layer then carries the replacement values.

Does this cover SAP?

SAP tables are covered by Synthesized for SAP. For long texts and attachments stored in SAP, bring a sample to the 48-hour proof.

The platform underneath, in production

Documents run on the same platform banks and insurers already trust with their test data.

Documents and text use the same policies, the same engine and the same deployment as these results.

Banking · test data80%less time to provision test data, with compliant data generated through the API inside CI/CD.Deutsche BankCase study
Insurance · security0security waivers across 14 priority applications: 28M+ rows secured, 100% referential integrity, test data 60% faster.Global specialty insurerCase study

Published results from database and synthetic data work on the Synthesized platform.

Close the gap in your next refresh

Bring one test environment. We'll show you what sits beside the tables and how much of it can be masked today.

Get a 48-hour proof