Data Protection and Enforcement

Block Risky Access, Mask Sensitive Data, and Protect Data Copies

Apply firewall, masking, encryption, and Generative AI controls through methods matched to the source and data state.

Book a Demo Explore Integrations

Database Firewall
Masking and Test Data
Encryption and AI Controls

Protection family

Protect data in use, in copies, and at rest

DataSunrise protects data while it is queried, copied, stored, and sent to Generative AI services. Teams can choose the control that matches the data state and the outcome they need.

Controls range from stopping risky live requests to creating protected copies for development, testing, and analytics.

Protection workflow

Match the control to the data state

DataSunrise protects live traffic, sensitive results, non-production copies, and Generative AI interactions.

Data in use

Database Firewall
Dynamic Data Masking
AI masking and prompt controls

Data in copies

Static Data Masking
Synthetic Data Generation
Test Data Management

Stored PostgreSQL data

Selected columns or complete tables
Managed key exchange
Authorized proxy access

Monitoring shows what is happening and records evidence. Protection controls can block or mask live traffic, create protected copies, or encrypt selected PostgreSQL data.

Product evidence

See the workflow in DataSunrise

Product screens show how policy, evidence, and protection appear in practice.

DataSunrise Dynamic Masking Rules list showing policies for TiDB, MSSQL, Elasticsearch, and PostgreSQL, with instance, Mask action, and rule type — **Dynamic Masking rule inventory** Dynamic Masking Rules list each policy with its database type, target instance, action, and rule type. This screen shows Mask Columns, Mask Fields, and Mask Data policies across TiDB, MSSQL, Elasticsearch, and PostgreSQL.

DataSunrise Dynamic Masking Rule Details for PostgreSQL TestDB, showing a wizard-generated fixed-string GDPR masking policy and its general settings — **Dynamic Masking rule details** Rule Details tie a masking policy to its database type and target instance before action conditions are configured. This wizard-generated example names a fixed-string GDPR policy for the PostgreSQL instance TestDB.

DataSunrise Masking Settings with Mask Columns selected for customer fields including names, email address, location, and IP address — **Masking scope by database column** The Masking Settings tree scopes a rule to specific database objects and columns. Here, Mask Columns is selected for the public.customers table, including names, email, address, location, and IP fields.

1 / 3

Protection workflows

Explore Data Protection and Enforcement

1 / 4

Protect Live Database Traffic

The DataSunrise Database Firewall evaluates requests through an inline proxy before they are executed. Rules can use the database user, configured application user, source, object, operation, time, and other session context to allow, block, or handle the request.

Dynamic Data Masking uses the same active path to change sensitive values in query results while the stored data remains unchanged.

Create Protected Data for Non-Production Work

Static Data Masking applies configured masking methods in batch tasks and writes a de-identified target for development, testing, analytics, or approved data sharing.

Test Data Management combines Static Data Masking with Synthetic Data Generation, so teams can prepare useful non-production datasets without relying only on clear production data.

Encrypt Selected PostgreSQL Data

PostgreSQL Encryption at Rest is a licensed workflow for selected columns or complete tables. It uses PostgreSQL pgcrypto and AES-128 with DataSunrise proxy query rewriting and managed key exchange.

Keys can be stored internally or through CyberArk and AWS KMS. Authorized applications receive clear values through the managed proxy path.

Protect Generative AI and Salesforce Responses

Generative AI Data Masking and Prompt Controls use Information Types to mask sensitive prompt or response fields and block risky prompts across OpenAI, ChatGPT, Claude, Bedrock, Azure AI, and Gemini.

Salesforce Dynamic Data Masking protects sensitive values in Salesforce responses while the source record remains unchanged.

FAQ

Frequently Asked Questions

Can passive monitoring block or mask traffic?

No. Passive monitoring records activity without changing it. To block a request or mask a live result, traffic must pass through DataSunrise.

Can DataSunrise authenticate users before they reach the database?

Yes. Authentication Proxy can verify users for supported database connections before DataSunrise forwards the session. Supported databases and identity methods depend on the authentication path.

Can DataSunrise require two-factor authentication for database access?

Yes. In supported proxy authentication workflows, DataSunrise can require a second verification step before a user connects to the database. Available methods depend on the database and authentication path.

Does Dynamic Data Masking change stored data?

No. It changes the result shown to the user while the stored value remains unchanged. Static Data Masking, on the other hand, creates a de-identified copy.

Which databases does DataSunrise Encryption at Rest support?

It supports PostgreSQL and Amazon Aurora PostgreSQL.

Map the right workflow

See how DataSunrise works with your technology stack

View Integration Examples