Bait-Mask · a Northstar tool · v0.2.0
Mask your staging database. Trap whoever steals it anyway.
Random fakers break foreign keys and email-uniqueness constraints. Bait-Mask doesn't. Every real value is replaced with a deterministic, mathematically-linked fake — [email protected] always becomes the same fake address, everywhere it appears, across all your tables — so your staging data stays relationally intact. And because the fakes route to a domain you control, anyone who actually uses the leaked data trips a wire.
The actual problem
Staging data is either broken or unmasked. Pick your poison.
SOC2 and GDPR require zero production PII in staging. Most teams solve this with a random Faker script, or don't solve it at all.
- The usual approach
- Random fakers break your database. Fresh random values on every run means the same customer's email no longer matches across tables. Foreign keys break. Unique constraints fail. Engineers stop trusting the staging environment, then stop using it — which defeats the entire point of having one.
- The other usual approach
- Or nobody masks anything. Masking is slow and annoying to get right, so a lot of teams quietly skip it. That's the version that shows up in a SOC2 finding, or in a breach report, whichever comes first.
How it works
Deterministic masking, with a tripwire built into the fake data itself.
Three things happen to every PII value Bait-Mask touches.
- 01 · Deterministic replacement
- The same real value always produces the same fake value, derived via
HMAC-SHA256from a local master seed you control. Relational integrity survives masking because the fakes are consistent, not random. - 02 · Fail-closed, always
- A value Bait-Mask doesn't recognize gets redacted or the run aborts — never silently passed through unmasked. An earlier draft of this exact idea leaked real secrets on unrecognized formats; that failure mode is the one thing this tool is built to never do.
- 03 · Honeytoken by construction
- Fake emails resolve to a trap domain you own. Nothing extra to configure — if a stolen staging dump ever gets used for real, the fake data itself is what tells you.
Try it
Try the actual transform.
This runs the real algorithm — HMAC-SHA256 via your browser's own crypto engine, right now, nothing sent to a server. Type an email, get its deterministic fake. Type the same one again, get the identical result.
How you run it
One tool, three ways to run it.
CSV and NDJSON scrubbing for exports, or a live streaming pipe straight from pg_dump into psql that never writes the raw dump to disk.
- Deterministic masking for emails, API keys, UUIDs, and any other PII column via configurable rules
- Real streaming
pg_dumpCOPY-block parser — not a CSV shim, the actual Postgres wire format - ~35 built-in column-name rules out of the box, override or extend with your own JSON rules file
- Master seed comes from an environment variable only — never a CLI flag, never in shell history
- Offline, Ed25519-signed license check — no phone-home, no network call to verify you're licensed
- Ships as a standalone Linux binary — no Python runtime required on the machine that runs it
Pricing
One price. No per-seat fees, no per-environment fees.
Unlimited use across your whole organization — every environment, every seat, every column-rules file you write.
Flat. Unlimited environments and seats within your org. One signed license file, issued directly by us. Renews annually. No usage metering, no feature gates between "tiers" — there's only one tier. Covers all masking rule types (email, API key, UUID, generic), the pg_dump streaming pipe (unlimited use), unlimited custom rules files, and direct email support from the person who built it.
A real, time-boxed license — not a crippled demo build. Every feature works exactly as it will after you pay. Self-serve: tell us your org name, we issue the license same day.
Card checkout: clicking "Get a license" opens Stripe's own hosted checkout page — we never see or handle your card details. Your license is signed and emailed automatically the moment payment completes. Prefer a manual invoice, bank transfer, or have questions first? Use the contact form instead.
Founding customer discount: the first 10 organizations to license Bait-Mask get 40% off the first year ($1,800) — enter code FOUNDING40 on the Stripe checkout page, or mention it via the contact form. This is genuinely limited — v0.2.0 has no independent audit yet (see below), and the discount reflects that honestly rather than a marketing gimmick.
Running a Leviathan Platform pilot? Every pilot ($500, 30 days) includes 12 months of Bait-Mask at no extra charge — see the Leviathan Platform pricing. Buying Bait-Mask standalone doesn't require any Leviathan Platform purchase; the two are priced and licensed independently.
License delivery is automated end to end — a completed purchase signs and issues your license immediately, no manual step in between.
Trust & release state
Real, and pre-release. Both true at once.
Stop choosing between a working staging database and a compliant one.
No sales call needed to get started.