Baffle is the only security platform that cryptographically protects data as it's created, used, and shared across cloud-native data stores.

Baffle Shield for Postgres Static Data Masking is specifically designed to copy and obfuscate sensitive production databases into development, testing, and DevOps lower environments. Eliminate the security and compliance issues with sensitive data in your pre-production environments.

Baffle Shield is a proxy placed in-line between your production and pre-production databases and operates on the SQL commands. Use AWS DMS or native Postgres tools like pg_dump or pg_replication for migration (one-time or continuous updates)

Format Preserving Encryption (FPE) protects data while preserving the original data type and length. This is critical for testing applications without modification as well as testing infrastructure for processing, storage, and bandwidth requirements. No corresponding token vault is required, eliminating the need to manage and secure that or worry about related performance issues. The data can be restored later if desired or the encryption key can be destroyed to ensure the data is never recovered. Envelope encryption ensures that Baffle software never has access to your key encryption keys (KEK), enabling you to bring your own keys (BYOK) in AWS KMS.

Both source and target databases must be PostgreSQL (AWS EC2, RDS, or Aurora RDS). .

Note! Baffle Manager is a web-based orchestration tool that configures, manages, and reports on Baffle Shields. Baffle Manager is free and also available in the AWS Marketplace.