Test data management that serves every team, not just developers

Test data management is the practice of finding sensitive data, protecting it, and delivering realistic, referentially intact copies to the teams and systems that build and test software. It used to serve developers alone. The same production-shaped data now feeds testers, performance engineers, analysts, AI and machine learning pipelines, third-party processors and auditors, and each needs a different shape of it.

Masking is one technique inside test data management. Masking changes sensitive values so they cannot identify anyone. Test data management covers the whole lifecycle: finding where sensitive data lives, deciding how each classification should be protected, and delivering the result through subsetting, pipelines, file gateways or virtual copies. A masking tool without discovery only protects the fields somebody already knew about.

Minutes, not weeks. The delay in most organizations is not the copy itself but the queue in front of it: a ticket, a DBA, a clone, then a masking job. Where virtual copies are served from an already-masked snapshot, provisioning is a matter of minutes and does not consume a full copy of storage. The number worth measuring is request to usable environment, not how long the job runs.

Through database virtualization. Many writable copies share one masked golden snapshot plus their own changes, which cuts non-production storage by up to 90% and brings provisioning down from days to minutes. Masking is applied when the snapshot is created, not after a clone exists, so every copy served from it is protected on arrival and there is no window in which real data sits in a non-production environment.

Yes. Discovery is patented and score-based, and it reads free-text and unstructured content as well as structured sources, combining dictionary and pattern matching with validation, data matching, and model-based analysis. This matters because the sensitive values that cause problems are usually the ones nobody labeled — an account number pasted into a support note, an identifier in a repurposed column.

It depends on whether protection is fit for purpose or applied uniformly. Blanket redaction destroys format, distribution and consistency, and will break a test suite. Fit-for-purpose protection selects a method per data element: format-preserving encryption keeps an identifier's shape so joins resolve, generalization turns a date of birth into an age band so the statistical signal survives, and deterministic masking means the same customer looks the same in every system.

Four delivery mechanisms plus virtualization, all running from a single policy definition: in-place masking of an existing copy, extract-mask-load pipelines with protection applied in transit, secure file gateways that mask files as they land in object storage, self-service provisioning, and writable virtual copies. Adding a mechanism later does not mean rebuilding the policies.

Yes, and the obligations are specific. PCI DSS v4.0.1 Requirement 6.5.5 bars live primary account numbers from pre-production environments unless those environments are in the cardholder data environment and protected accordingly. HIPAA sets a de-identification standard under 45 CFR 164.514(b). Under GDPR, pseudonymized data that can still be attributed to a person remains personal data. What all three reward is protection applied before the copy exists, and a record that shows it.

Training and evaluation sets are copies of production like any other, and they tend to be the least governed because engineering creates them rather than a business process. The control point is extraction, before the data reaches the pipeline, because a model cannot be made to unlearn what it was trained on without retraining. Treat an AI training set as another consumer of test data, governed by the same policy.

28 native connectors supporting more than 100 integrations across databases, data warehouses, file stores, analytics platforms and workstations, with accelerators for Oracle ERP, SAP, Snowflake and BigQuery. Deployment is on-premises, cloud or hybrid.

Yes. Mage Data delivers test data through the routes your teams already use: in place, in transit, as virtual copies, or through file drops. You can move one workload at a time while your current tool keeps running.

They come with you. Policy migration brings your existing masking rules and classifications across, and side-by-side validation lets you compare the output on the same data before anything is switched off.