Welcome to DDM

DDM (Dynamic Data Masking) is a SQL proxy that sits transparently between your applications and your databases, masking sensitive data in query results in real time — without changing the underlying data or the client application.

DDM speaks the native wire protocol of each supported engine, applies configurable masking rules to results on the fly, and logs the traffic for auditing.

Highlights

• Transparent proxy — drop it in front of an existing database; clients connect to DDM instead of the database.
• Real-time masking — sensitive columns are masked in query results as they pass through.
• Broad database support — Oracle, MSSQL, MySQL, PostgreSQL, SAP HANA, Teradata, Cassandra, MongoDB, Couchbase and DB2 (including z/OS).
• Query logging & auditing — every proxied statement can be recorded.
• SQL access policies — allow (WHITE) or block (BLACK) SQL statements that match a pattern or regular expression.
• Group-based assignment — masking groups and policy groups are assigned to user groups instead of individual users.
• Discovery integration — sensitive data classifications are imported from a supported discovery solution and masking methods are applied automatically.
• Approval workflows — BPMN workflows can be designed, deployed, and scheduled from the management interface.

Where to next

• Before Installation — prerequisites and planning.
• Docker Installation — get the stack running.
• Overview — how DDM works end to end.
• Mask Operations — masking rules, groups, methods, and configuration.
• Policy Operations — allowing or blocking SQL statements.