Private runtime
Run masking inside your Snowflake account with the Native App, or in your own infrastructure with the self-hosted container. Processing stays within the deployment boundary you choose.
Agent Mask
Redact PII where your data lives. Use Agent Mask from Snowflake SQL or a private Docker API to de-identify sensitive text, related fields, and supported documents without sending payloads to an external redaction service.
What Agent Mask does
Section titled “What Agent Mask does”9 de-identification operators
type_numbered, constant, mask, hash, faker, encrypt, keep, entity_type, and date_shift — configurable per entity type.
Custom entity detection
Describe what you’re looking for in plain English, or define regex patterns. Mix both with built-in entity types in a single call.
Identity-aware masking
Group aliases such as “John Smith”, “John”, and “Dr. Smith” so related mentions can receive the same replacement.
Documents built-in
Detect sensitive text in PDFs, scanned PDFs, images, DICOM, DOCX, RTF, and ZIP archives. For supported visual formats, request redacted file output and redaction metadata.
SQL or API workflow
Call one Snowflake SQL function or one private HTTP API for text, related fields, and supported documents. Responses can include de-identified output and review metadata.
Quick example
Section titled “Quick example”SELECT app_public.mask( 'Patient John Smith, SSN 078-05-1120, email john@example.com');A default type_numbered replacement renders the first column as:
[PERSON_1], SSN [US_SSN_1], email [EMAIL_ADDRESS_1]The response can also include analyzer results and an entity_ledger that maps detected original values to the replacements used in the output.