Masking Sensitive Data in Sandboxes

Question

Does anyone have experience of masking sensitive data in a sandbox?

Our organisation holds lots of sensitive data, specifically in the User object.

We also use multiple sandboxes for development, and as a security step, would like to mask (de-sensitise) selected fields once we have refreshed our sandboxes from production. This refresh task would likely take place at regular intervals.

Also we are providing these sandboxes access to some external vendors, inoder for them to restrict from contacting users.

Other than Dataloader/Informatica ( since its taking manual effort), what would be the alternative way of masking the data.

Appreciate the response.

Thanks, Pavan

Answer 1

There are a couple of solutions to this:

• Homegrown - Use the SandboxPostCopyInterface and write your own apex class that implements method runApexClass(context). This can kick off a batch class to do the anonymization.

• Vendor appexchange solution like OwnBackup

Answer 2

A few years after this question was asked, Salesforce released the Data Mask feature to cover this exact use case.

Data Mask is a data security tool that obfuscates confidential or protected information when deploying Sandbox environments on Salesforce. Data Mask supports multiple approaches, including anonymization, pseudonymization, and deletion, to irreversibly replace or erase sensitive data.

With Data Mask you can:

• Choose between anonymization, pseudonymization, and deletion
• Select which objects and fields you wish to obfuscate
• Configure the type of data used for obfuscation