A mask with entities masks the emails, phone numbers, card numbers, and other entities found in a value, and keeps the rest of the text.

Set entities on a mask block to a list of entity names, or to ALL:

notes.hcl

script "query" "notes" {
  query "rows" {
    sql    = "SELECT id, body FROM notes ORDER BY id"
    format = CSV
    mask {
      columns  = ["body"]
      entities = [EMAIL, PHONE]
    }
  }
}

Each entity is replaced by its name, and a value holding none passes through unchanged:

1,Call <PHONE> or mail <EMAIL>
2,Nothing to hide

The entities are CREDIT_CARD, EMAIL, IBAN, IP, MAC, PHONE, SSN, and URL. REDACT writes the entity name, and PARTIAL and HASH mask each entity on its own.

Mask Groups

A top-level mask can group other masks with use, so a query applies all of them with one reference:

mask "pii" {
  columns = ["email", "ssn"]
  method  = REDACT
}

mask "phones" {
  columns    = ["phone*"]
  method     = PARTIAL
  keep_right = 4
}

mask "customer" {
  use = [mask.pii, mask.phones]
}

Next Steps

Read the Masking Sensitive Output guide to learn what each entity matches. Test datasets use the same masks on the rows they load.

Data Scripts: Mask Entities in Free Text

Mask Groups

Next Steps