DataMasque for Guidewire Cloud

Table References

A table reference points at an existing table or a file of key-to-value rows, and a ruleset can read it as a lookup while masking. Used as a masking seed, it keeps masked values consistent across separate systems.

Condition Values from a Table Reference

The in and not_in conditions can now read their values from a table reference column, so the list of permitted values lives outside the ruleset instead of being repeated inside it.

Shared Hash Columns Across Foreign Keys

A new ruleset generator option, on by default, applies your Table Hash Column selection to the matching column in every table it joins to, letting related tables share a single hash column.

Cross-Account Resource Tagging

PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, IBM Db2 LUW and Amazon Redshift connections can now hold an IAM role ARN, which DataMasque assumes to tag an RDS, Aurora or Redshift resource in another AWS account. Tagging now also works in the China and ISO partitions.

File Discovery Summary in the Run Log

Discovery runs now report how many files were scanned and how many were skipped, with a per-extension count for each reason a file was passed over.

Filter Run Logs by Multiple Statuses

The run logs can now be filtered by more than one Run Status at a time.

Shared In-Data Discovery Settings

A discovery configuration library can hold an idd_settings block, letting discovery configurations import their In-Data Discovery settings instead of repeating them.

In-Data Discovery On by Default

In-Data Discovery is now enabled by default for discovery runs and in new discovery configurations. Safe Data Preview remains opt-in, and saved discovery configurations keep whatever setting they already have.

Sensitive Classification Takes Precedence

When a column or file field matches both a sensitive and a non-sensitive rule, discovery now reports the sensitive classification. Existing discovery results may show a different classification after upgrading.

New Default Matcher Priority

The default matcher priority for unstructured masking is now context_sources, regex, checksum, seed_files, ai_detect. Masked output can change for an existing ruleset where two matchers find the same text.

Smaller PDFs and Lower Memory Use

PDF masking now embeds one copy of each substitute font per document rather than one per page, producing smaller masked PDFs and using considerably less memory on long documents.

Multi-Table and Parallel DynamoDB Masking

An Amazon DynamoDB ruleset can now mask more than one table, run its task blocks in parallel, and split the masking of a single table across several workers.

Explicit Label Masking in Ruleset Generation

Each label in a ruleset generation configuration must now set exactly one of preset_mask, mask, skip_generation or the new use_data_type_default. A label setting none of them stops the configuration from generating a ruleset; add use_data_type_default: true to preserve its previous behaviour.

Direct Navigation to a Run

Opening a run from a link now loads its page in the run logs immediately, instead of stepping through each page to find it.

API Keys Survive Password Changes

A user's API key is now replaced rather than removed when their password changes, so View run command always has a token available. New accounts receive their first key when the temporary password is replaced.

XML CDATA Masking Fix

Fixed XML masking leaving an element's text unmasked when wrapped in CDATA, and masking only part of the text when a child element or comment split it. A text transform now masks an element's whole text as a single value and writes CDATA sections back as plain text.

File Discovery Sensitive Results Fix

Fixed file discovery hiding a result from the sensitive-only view unless the displayed match was itself sensitive. A result now counts as sensitive unless every one of its matches is non-sensitive, so its data no longer drops out of the review or the generated ruleset.

IBM Db2 LUW Foreign Key Discovery Fix

Fixed foreign key discovery on IBM Db2 LUW reporting a table's own primary key as a foreign key when another table held a constraint of the same name.

PDF Image Placement Fix

Fixed PDF masking discarding the flip and rotation carried by an image's placement. Open vector paths are also no longer closed when the document is rebuilt.

Unstructured Preview Non-ASCII Fix

Fixed the Unstructured Ruleset Builder preview masking the wrong part of text containing non-ASCII characters, which could leave some of the original text visible. Masking runs were not affected.