Veramask API

Anonymize, Protect, Insure

Data Transformation

Transformation Strategies

Diagram: Veramask transformation strategies (mask, redact, replace, hash, substitute).

Understanding Anonymization Strategies

In the Veramask API, a strategy defines the specific method used to handle sensitive data (PII) once it has been detected. Strategies determine how the original sensitive information is transformed—whether it is obscured, replaced, or removed—before the final output is returned.

Default Strategies

When no specific instructions are provided in the overrides object of your request, the service automatically applies a default strategy based on the type of entity detected. These defaults are designed to balance data utility with privacy:

Entity Type Default Strategy Implementation Logic
CREDIT_CARD Masking Mask all but last 4 digits (e.g., ****1234).
CRYPTO Hashing Full SHA-256 hash.
DATE_TIME Jittering Move the date by a deterministic offset in [-7, +7] days.
EMAIL_ADDRESS Synthetic Substitution Fake email address.
IBAN_CODE Partial Hashing Keep Country Code + last 4; hash the middle.
IP_ADDRESS Masking Mask the last octet (e.g., 192.168.1.0).
MAC_ADDRESS Masking Mask the last 3 octets (e.g., AD:F3:7A:00:00:00).
NRP N/A Replace with the NRP tag (e.g., [RELIGIOUS_GROUP]).
PERSON Synthetic Substitution Replace with a fake name from the same locale.
LOCATION Synthetic Substitution Replace with a state.
PHONE_NUMBER Synthetic Substitution Replace with a fake phone number.
MEDICAL_LICENSE Fixed Pattern Replacement Replace with fixed pattern (e.g., MD-XXXXX).
URL Redaction Remove query strings; keep the base domain.

Overriding Strategies

You can customize how specific entities are handled by providing an overrides object in your request body. This allows you to enforce stricter privacy or specific formatting requirements per entity type.

How to Override

  1. Identify the Entity: Use the entity type (e.g., PERSON, EMAIL_ADDRESS) as the key in the overrides object.
  2. Define the Strategy: Provide a strategy object as the value.

Supported Strategies:

Type Description Example
mask Partially obscures detected values while preserving part of the original format. Request 
{
  "data": "Alice Smith can be reached at asmith@mygoogle.com",
  "overrides": {
    "EMAIL_ADDRESS": {
      "type": "mask",
      "masking_char": "*",
      "chars_to_mask": 5,
      "from_end": false
    }
  }
}
Response 
{
  "masked_data": "Jane Doe can be reached at *****h@mygoogle.com"
}
redact Removes the detected value entirely. Request 
{
  "data": "Alice Smith can be reached at asmith@mygoogle.com",
  "overrides": {
    "EMAIL_ADDRESS": {
      "type": "redact"
    }
  }
}
Response 
{
  "masked_data": "Jane Doe can be reached at "
}
replace Substitutes the detected value with a fixed caller-provided value. Request 
{
  "data": "Alice Smith can be reached at asmith@mygoogle.com",
  "overrides": {
    "EMAIL_ADDRESS": {
      "type": "replace",
      "new_value": "dummy@example.com"
    }
  }
}
Response 
{
  "masked_data": "Jane Doe can be reached at dummy@example.com"
}
hash Replaces the detected value with a SHA-256 hash (salted when consistency_salt is set). Request 
{
  "data": "Alice Smith can be reached at asmith@mygoogle.com",
  "overrides": {
    "EMAIL_ADDRESS": {
      "type": "hash"
    }
  }
}
Response 
{
  "masked_data": "8f223fc..."
}
substitute Replaces detected values with realistic synthetic data (synthetic substitution). Request 
{
  "data": "Alice Smith can be reached at asmith@mygoogle.com",
  "overrides": {
    "EMAIL_ADDRESS": {
      "type": "substitute",
      "attribute": "state"
    }
  }
}
Response 
{
  "masked_data": "Jane Doe can be reached at Deanbury"
}