The data masking feature allows you to hide or encrypt sensitive details in incoming messages, contact information, custom object properties, and records through pattern masking using regular expressions (regex). This powerful tool helps maintain confidentiality and ensures compliance with data protection regulations. By implementing data masking, you can safeguard personal information while still leveraging the data you need for analysis and decision-making. In this article, we will guide you on how to effectively use data masking to enhance your data security and privacy.

Why does data masking matter?

Data masking is essential for several key reasons:

1. Enhanced security: Data masking minimizes the risk of unauthorized access by obscuring sensitive information. This is particularly crucial in environments where data is shared among multiple users or systems.
2. Regulatory compliance: Many industries are subject to strict data protection regulations. Data masking helps organizations comply with laws such as GDPR and HIPAA by ensuring that personal data is not exposed unnecessarily.
3. Risk mitigation: In the event of a data breach, masked data can help limit the exposure of sensitive information, thereby reducing potential liability and financial losses.

How does data masking work?

Data masking replaces sensitive values with masked characters (for example, *) when data is viewed by certain users or returned by APIs.

SleekFlow supports two ways to mask data, depending on how much control and flexibility you need:

1. Simple data masking for email and phone number
   1. This option lets you quickly mask email addresses or phone numbers stored in contact data, without using regular expressions.
   2. You can:
      1. Choose whether to mask email or phone number
      2. Decide how much of the value is masked (full or partial)
      3. Control which user roles see masked values
      4. Optionally apply masking to API responses
   3. This setup is ideal if you want a guided, low-effort way to protect commonly sensitive contact information.
2. Pattern masking using regular expressions (regex)
   1. Pattern masking allows you to define custom masking rules using regular expressions.
   2. With pattern masking, you can:
      1. Mask sensitive data in incoming messages, contact properties, custom objects, and API responses
      2. Create multiple masking patterns for different data types
      3. Apply masking selectively by location and user role
   3. This option is best suited for advanced or highly customized compliance requirements.

What does it do?

1. Hides sensitive information: For example, if you configured a Hong Kong phone number regex pattern as the masking pattern, the feature can mask the customer phone number from view, changing 98769876 to ********. This ensures that sensitive information is not exposed to unauthorized users.
2. Maintains data structure: While the actual data is hidden, you can still see that the data is a phone number or an email address without revealing the real information.
3. Customizable patterns: You can set up your own regex patterns for masking data based on your needs. Whether it’s hiding credit card numbers, email addresses, or other sensitive details, the feature allows you to define how data should be masked.

Setting up data masking

Access the “Data masking” page

To reach to the “Data masking” page, follow these steps:

1. Go to the “Settings” page by clicking the icon on the left-hand navigation bar
2. Under the “Company Settings” section, click “Data masking”
3. You will be redirected to the “Data masking” page

Option 1: Mask email and phone number (simple setup)

This option allows you to quickly mask email addresses or phone numbers stored in contact data, without creating regular expression (regex) patterns.

Use this setup if you want a guided way to protect commonly sensitive contact information while controlling which user roles can view unmasked data.

You can follow the steps below to mask email and phone number:

1. In the “Data masking” page, click on the “Mask email and phone number” button on the top right corner
2. A pop-up modal will appear
   
3. Click on the “Contact property” dropdown and select masking either email or phone number
   
4. Follow the steps in the next section to mask email or phone number

Masking email address

Once you have selected “Email” in the previous step, additional configuration fields will appear. Use these fields to define how email addresses should be masked and who can view the unmasked data.

Fill in the following fields in the modal:

1. Name
   It is pre-filled as Email by default.
   You can edit the name if needed. The name must be unique.
2. Masking rule
   Choose how the email address should be masked:
   1. Mask entire email: Example: john.doe@gmail.com → *********************
   2. Mask entire email prefix: Example: ****@gmail.com
   3. Mask after first letter in prefix: Example: j****@gmail.com
   4. Mask domain: Example: john.doe@*****
3. Hide from
   Select the user role(s) that should see masked email values.
   Users in the selected roles will see masked email addresses in the platform.
4. Apply masking in
   This field is fixed as “Contacts” and cannot be changed.
   Email masking applies to contact profiles, contact lists, and contact exports.
5. (Optional) API response
   Toggle API response to control email masking in API responses:
   1. Off (default): APIs return unmasked email values
   2. On: APIs return masked email values

Once you have finished filling in the details, click “Mask” to save your settings. After saving, the email masking rule takes effect immediately.

Masking phone number

Once you have selected Phone number in the previous step, additional configuration fields will appear. Use these fields to define how phone numbers should be masked and who can view the unmasked data.

Fill in the following fields in the modal:

1. Name
   1. It is pre-filled as Phone number by default.
   2. You can edit the name if needed. The name must be unique.
2. Masking rule
   Choose how the phone number should be masked:
   1. Full phone number masking
      Masks the entire phone number, including the country code.
      Example: +852 9123 4567 → ***********
   2. Partial phone number masking
      Configure the following options:
      1. Masked digits: Enter the number of digits to mask. The minimum value is 4.
      2. Start masking from:
         1. Back: Example: +852 9877 ****
         2. Front (after country code): Example: +852 **** 1234
         3. Front (including country code)
         4. Hide from
3. Select the user role(s) that should see masked phone number values.
   Users in the selected roles will see masked phone numbers in the platform.
4. Apply masking in
   This field is fixed as Contacts and cannot be changed.
   Phone number masking applies to contact profiles, contact lists, and contact exports.
5. (Optional) API response
   Toggle API response to control phone number masking in API responses:
   1. Off (default): APIs return unmasked phone number values
   2. On: APIs return masked phone number values

Once you have finished filling in the details, click Mask to save your settings.

After saving, the phone number masking rule takes effect immediately.
 

Option 2: Create a masking pattern

You will need to create a masking pattern to mask information on SleekFlow.

To create a masking pattern, you can follow these steps below:

1. Click. on the “Create new pattern” button on the right top of the page
2. A “Create new masking pattern” modal will pop up and you can configure your masking pattern
   
3. Below are the details for each field:

4. Once you have completed the configuration, you can click “Create” to create your new pattern

Edit a masking pattern

To edit a pattern, follow the steps below:

1. Hover on the pattern you would like to edit
2. Click on the icon, and a drop-down menu will appear
3. Select “Edit”, and a “Edit masking pattern” pop-up modal will appear
   
4. Once you have updated the pattern. click “Done”. Your masking pattern will be updated

Delete a masking pattern

To delete a pattern, follow these steps:

1. Hover on the pattern you would like to delete
2. Click on the icon, and a drop-down menu will appear
3. Select “Delete”, a warning modal will appear. Click “Delete” to confirm the deletion
   
4. The pattern will be deleted. All the previously masked data will now be unmasked.

Common masking patterns

SleekFlow’s ‘Data Masking’ feature provides you with the flexibility to customize the masking pattern based on your business needs, allowing you to protect sensitive data. Below are some common regex pattern examples you can use in SleekFlow. 

Email address

Basic email regex

Allow subdomains

Allowing special characters

Credit card number

Basic credit card number

Credit card number with dashes

Credit card number with spaces

Flexible credit card number (spaces/dashes)

American Express

Visa

Mastercard

Discover Card

Diners Club

JCB Card

Phone number

Hong Kong

Singapore

Malaysia 

Indonesia

United Arab Emirates

Brazil

Identity card

Hong Kong (HKID)

Singapore (NRIC)

Malaysia (MyKad)

Indonesia (KTP)

United Arab Emirates

Brazil (RG)