A native Polars plugin that masks sensitive data inside your pipeline — zero rows leave your infrastructure, zero Python overhead per row.
Like-for-like structured-PII masking (email, phone, IP, IBAN, card) vs Presidio on 1M rows. Methodology & full numbers →
Built for engineers who can't afford cloud vendors in their data path — or simply don't want them there.
No network calls, ever. Runs offline, in CI, behind firewalls, inside VPCs. Your data never touches an external server — by architecture, not by policy.
FPE mode (FF3-1 AES-256) produces reversible pseudonymization under GDPR Art. 4(5). Same format, different value, decryptable only with your key — which MaskOps never sees.
RUT (Chile), CPF (Brazil), CURP (Mexico), IBAN, VAT, EU national IDs, email, phone, IP, credit cards. Built for the regulatory landscape of today's data-driven business.
Compiles to a native .so that Polars loads as an expression plugin. Zero Python overhead per row. Parallelism via Rayon, automatic.
contains_pii tells you if a column has PII before you mask it. Useful for audits, schema validation, and compliance checks in existing pipelines.
Each pattern declares its regulation, compliance category, and validation logic. Suitable for CMF NCG 311, ISO 27001, and SOC 2 auditor documentation.
import polars as pl import maskops # 32-byte key + 7-byte tweak — stays with you key = pl.lit(bytes.fromhex("a1b2c3...")) tweak = pl.lit(b"season1") df = pl.read_parquet("transactions.parquet") # pseudonymize — format preserved, reversible masked = df.with_columns( maskops.mask_pii_fpe("rut", key, tweak), maskops.mask_pii_fpe("phone", key, tweak), ) # 12.345.678-9 → 87.162.043-5 (reversible) # +56 9 8765 4321 → +56 9 2341 8907
Pseudonymized data — where re-identification requires a separately-held key — still falls under GDPR, but with significantly reduced risk and lighter compliance burden. Under Art. 32, pseudonymization is an explicitly recommended security measure. MaskOps FPE mode is a direct technical implementation of that requirement. The key stays with you. The regulator is satisfied. Your analytics team keeps working.
On the cryptography: FF3-1 is proposed for deprecation in NIST's draft SP 800-38G Rev.1. We document the status, our mitigations, and the FF1 migration path openly — read the security note →
PII identifiers matched to the regulation that makes them sensitive.
Start with a paid pilot on your own data, with the fee credited in full when you convert. No procurement committees, no annual lock-in.
One Ley 21.719 fine can reach about USD 1.5M. One Brazilian finance-sector breach averages R$8.9M. A retainer is a rounding error against either.
MaskOps itself is 100% open source under MPL-2.0 — every pattern, the CLI, and the policy engine. Paid plans are support and compliance services, not a different or closed version of the software.
Available to the first 10 clients only.
Your rate never increases — ever.
Request pricing. Hands-on help deploying MaskOps air-gapped and on-prem, guaranteed-response support, compliance reporting, and dedicated integration support for fintechs embedding it into their pipelines. Priced to your deployment and anchored to the exposure it removes, not a per-seat number.
Request pricing →Start on your own data, not a demo. A fixed 60 to 90 day paid pilot: MaskOps integrated into one Polars pipeline, masking rules configured for your PII, and one success test agreed up front (mask 1M rows in under 3 seconds, pass an auditor manifest review). The fee is credited in full when you convert, and refunded if the test fails. Your only risk is time.
pip install maskopsimport maskopsimport polars as pl import maskops df = pl.DataFrame({ "rut": ["12.345.678-9", "9.876.543-2"], "email": ["user@company.cl", "admin@corp.io"], "phone": ["+56987654321", "+5621234567"], }) masked = df.with_columns( maskops.mask_pii("rut"), maskops.mask_pii("email"), maskops.mask_pii("phone"), )
Book a 15-minute call to discuss a pilot. No procurement process, no deck.