Veramask API

Anonymize, Protect, Insure

FAQs

Frequently Asked Questions

Diagram: how Veramask anonymizes PII in text and JSON requests.

Veramask is a stateless PII anonymization API that processes text and JSON in volatile memory and returns the same structure with sensitive entities (names, emails, phone numbers, addresses, credit cards, and more) replaced. This FAQ answers the most common questions about how it works, what it retains, and how to integrate it.

Retention & Privacy

What is Veramask?

Veramask is a stateless middleware that detects and anonymizes PII in text and JSON payloads using configurable strategies (mask, redact, replace, hash, substitute).

Do you store the content of my requests?

No. The Service is stateless — request payloads are processed in volatile memory and are not persisted to disk or long-term storage.

Do you retain any logs or metadata about requests?

We may retain non-content metadata (for example: timestamps, request size, processing duration, and detected entity types) for monitoring and operational purposes. We do not retain the original request body or its raw content.

Is data encrypted in transit?

Use HTTPS/TLS when calling the API to protect data in transit. The Service expects clients and deployment platforms to use standard transport security.

Usage & Behavior

Which endpoints should I use to anonymize text or JSON?

Use POST /v1/anonymizeText for raw text and POST /v1/anonymizeJSON for JSON objects.

How do I get deterministic, repeatable anonymization?

Provide a consistency_salt (at least 16 bytes UTF-8) in settings. When present, substitution and hashing use the salt to produce consistent outputs.

Which locales are supported?

Only en_US is supported. Other locales will fail validation.

How can I override the default anonymization behavior for specific entities?

Send an overrides object mapping entity types (e.g., PERSON, EMAIL_ADDRESS) to a strategy object (type: mask|redact|replace|hash|substitute) in the request body.

Is there a request size limit?

Yes — there is a default max request body size, though this limit may vary based on your subscribed plan. Requests over the limit return 413 Payload Too Large.

Can I preserve parts of an original value (for example, last 4 digits of a card)?

Yes — use strategies like mask with configuration (e.g., chars_to_mask, from_end) or default strategy mappings (e.g., credit cards usually keep last 4 digits).