Data Security Glossary — Data Masking, Test Data & Privacy Terms Defined

The Mage Data Glossary of Data Security Terms is a reference guide to the data security, data privacy, test data management and AI data protection terms used across Mage Data’s AI-driven Data Security Platform. It defines terms from sensitive data discovery and static data masking to dynamic data masking, DSR fulfillment and AI guardrails, along with the regulations they help organizations meet, including GDPR, HIPAA, PCI DSS, Saudi Arabia’s PDPL, Qatar’s PDPPL and India’s DPDP Act.

The core sections follow the four imperatives of data privacy: know your data, eliminate unnecessary data, control access and automate compliance.

Last updated October 23, 2026

Platform and market categories Data sources Know your data Eliminate unnecessary data Control access Automate compliance Database virtualization Data security and privacy for AI Privacy regulations and compliance

Foundations

Platform and market categories

Data Security Platform (DSP)

A Data Security Platform is a single product that discovers, classifies, protects and monitors sensitive data across databases, files and applications. Mage Data is an AI-driven Data Security Platform that discovers data, eliminates unnecessary data, controls access and automates compliance from a single pane of glass, with capabilities ranging from discovery, data masking and monitoring to automated DSR fulfillment and AI guardrails.

Data masking

Data masking replaces sensitive values with realistic but fictitious or obscured values so data stays usable without exposing the real information. Mage Data offers static data masking for non-production copies and dynamic data masking for live production access.

Test Data Management (TDM)

Test Data Management is the practice of providing development and testing teams with realistic, compliant data quickly and repeatably. Mage Data's TDM combines static data masking, subsetting, database virtualization and flexible delivery so teams get safe data without waiting on manual requests.

Database Virtualization (DBV)

Database virtualization creates many lightweight virtual copies of a database that share one underlying copy of the data. It is part of test data management and is used to provision development and test environments in minutes instead of days.

Production data protection

Production data protection controls who can see real sensitive data in live systems, where it must exist. In Mage Data this covers dynamic data masking, the database firewall and database activity monitoring.

Data friction

Data friction is the delay and effort involved in getting usable data to the people who need it, such as waiting weeks for a database copy. Mage Data's test data management is designed to remove data friction.

Fit-for-purpose data

Fit-for-purpose data is data protected to exactly the level a specific use case needs. For example, a performance test may only need redacted values of the right length, while application testing needs realistic, context-preserving values.

Protect-then-monitor

Protect-then-monitor is the approach of removing or masking sensitive data first and monitoring only the real data that must remain. It contrasts with monitoring-first approaches that watch all data access but leave the data itself exposed.

Single pane of glass

A single pane of glass is one console that gives a unified view and control over many systems. Mage Data protects databases, files, applications, endpoints and AI tools from one platform instead of separate point products.

De-identified data

De-identified data has had direct identifiers removed or masked so it can no longer be easily linked to a person. Mage Data produces de-identified data that keeps its context and usability for development, testing and analytics.

Read more: Static Data Masking

Data consumer

A data consumer is any person or system that uses data, such as developers, DBAs, user acceptance testers, analysts or AI and machine learning pipelines. Mage Data delivers each data consumer the version of data that is fit for their purpose.

Data sources

Relational database

A relational database stores data in related tables of rows and columns, such as Oracle, Microsoft SQL Server or PostgreSQL. Mage Data discovers, masks and monitors sensitive data in both legacy and modern relational databases.

Cloud data warehouse

A cloud data warehouse is a managed analytics database in the cloud, such as Snowflake or Google BigQuery. Mage Data discovers and protects sensitive data in cloud data warehouses, including masking at query time.

Data lake

A data lake is a central repository that stores large volumes of raw structured and unstructured data in its native format. Mage Data scans and protects sensitive data in data lakes such as Azure Data Lake.

Object storage

Object storage keeps data as files, or objects, in cloud storage services such as Amazon S3, Azure Blob Storage and Google Cloud Storage. Mage Data detects and masks sensitive data in files stored or landing in object storage.

File storage

File storage covers file servers, network shares and directories that hold documents, spreadsheets, PDFs and other files. Mage Data discovers, tags, quarantines and masks sensitive files in file storage.

SaaS and web applications

SaaS and web applications are business applications delivered over the internet, such as Salesforce. Mage Data masks sensitive fields in these applications according to each user's profile.

Read more: Dynamic Data Masking

Packaged applications

Packaged applications are off-the-shelf enterprise systems such as Oracle E-Business Suite, Oracle PeopleSoft and SAP. Mage Data provides dedicated masking for packaged applications.

Streams and logs

Streams and logs are continuous flows of data, such as message queues, event streams and application logs, that can carry sensitive information. Mage Data protects sensitive data moving through streams and logs.

Endpoints

Endpoints are employee devices such as laptops and desktops, where sensitive files often accumulate unnoticed. Mage Data discovers and protects sensitive data on endpoints without slowing them down.

Know your data

Asset discovery

Asset discovery finds the servers and data services, such as databases, file shares and endpoints, that exist across an organization's network. Mage Data uses an agentless network scan to find every host and data service in an environment.

Sensitive data discovery

Sensitive data discovery is the automated process of locating personal, financial, health and other confidential data across databases, files and applications. Mage Data's patented, score-based discovery combines pattern matching and AI to find sensitive data across structured and unstructured data.

Shadow data

Shadow data is sensitive data that exists outside known, managed systems, such as forgotten database copies, exports and files on laptops. Mage Data's discovery identifies shadow data so it can be protected or removed.

Sensitive data inventory

A sensitive data inventory is a complete record of what sensitive data an organization holds and where it lives. Mage Data builds this inventory in days rather than months, and it powers every downstream protection.

Data classification

Data classification labels discovered data by type and sensitivity, such as email address, national identifier or health record. Mage Data ships with 80+ built-in data classifications, and every classification can be renamed or customized.

Classification policy

A classification policy is a group of data classifications that together represent what a specific regulation considers sensitive, such as GDPR, HIPAA or DPDP. Mage Data uses classification policies to scope discovery and protection to the rules a business must follow.

Dictionary-based discovery

Dictionary-based discovery identifies sensitive data by matching column or field names against known terms, such as "ssn" or "date_of_birth". It is fast and is usually combined with content-based methods for accuracy.

Pattern matching

Pattern matching identifies sensitive data by checking values against a known format, such as a credit card or phone number pattern. Mage Data pairs pattern matching with validation checks, such as the Luhn algorithm for card numbers, to reduce false positives.

Data matching

Data matching identifies sensitive data by comparing values against reference lists, such as common first names or a customer master table. It catches sensitive data that has no fixed format.

NLP-based discovery

NLP-based discovery uses natural language processing to find personal data inside free text, such as names and addresses in notes or comments fields.

LLM-based discovery

LLM-based discovery uses large language and vision models to find sensitive data in complex unstructured content such as call transcripts, PDFs and images. It is available in Mage Data's Enterprise edition.

Sampling-based discovery

Sampling-based discovery scans a representative sample of values in each column rather than every row. Because the goal is to find which columns hold sensitive data, sampling makes discovery fast on very large databases.

Incremental discovery

Incremental discovery scans only new or changed structures after the first full scan, so ongoing discovery stays fast as data grows.

Data catalog

A data catalog is a central inventory of an organization's data assets and their metadata, such as tables, columns, data types, owners and classifications. Mage Data includes a built-in catalog that stores discovery results and can share them with third-party catalogs through an API.

Data lineage

Data lineage traces where data comes from, where it moves and how it changes along the way. It helps teams understand how sensitive data spreads across systems.

Unstructured data

Unstructured data is information that does not sit in database tables, such as documents, PDFs, spreadsheets, images, emails and call recordings. Mage Data discovers and protects sensitive data in unstructured files as well as in databases.

Endpoint data discovery

Endpoint data discovery finds sensitive data in files stored on employee laptops and workstations. Mage Data's endpoint agent detects new or changed files and scans them centrally, off the device, so users see no slowdown.

File server discovery

File server discovery finds sensitive data in files stored on shared file servers and network drives. Mage Data scans file servers without installing agents on them.

Sensitivity tagging

Sensitivity tagging writes a classification label into a file's metadata so other security tools can act on it. Mage Data tags files it scans so existing data loss prevention (DLP) tools can enforce policies based on those tags.

File quarantine

File quarantine moves a file containing sensitive data into a protected, password-locked archive controlled by an administrator. It reduces exposure from unprotected files, for example during a ransomware attack.

User discovery

User discovery maps the people and AI agents in an organization to the sensitive data they can access. Mage Data integrates with identity and access management systems to show who, and which agents, can reach which data.

Read more: Database Activity Monitoring

Eliminate unnecessary data

Static Data Masking (SDM)

Static data masking permanently replaces sensitive values in a copy of a database so the copy can be used safely for development, testing, training or analytics. Mage Data's static data masking uses discovery results to apply the right masking method to each column automatically and runs much faster than hand-written scripts.

Read more: Static Data Masking

Masking method

A masking method is the specific technique used to protect a value, such as redaction, substitution or encryption. Mage Data offers 80+ masking methods, and new methods can be added as needed.

Read more: Static Data Masking

Privacy Enhancing Techniques (PETs)

Privacy Enhancing Techniques are methods that let organizations use data while protecting the individuals in it. Mage Data's PETs include realistic masking, format-preserving encryption and tokenization, and synthetic data with differential privacy.

Anonymization

Anonymization irreversibly transforms personal data so the individual can no longer be identified. Anonymized data generally falls outside the scope of privacy laws such as GDPR.

Read more: Static Data Masking

Pseudonymization

Pseudonymization replaces identifying values with consistent substitutes, so records can still be linked and analysed without revealing who they belong to. Unlike anonymization, it can be reversed by whoever holds the mapping or key.

Read more: Static Data Masking

Redaction

Redaction hides all or part of a value, for example showing a card number as XXXX-XXXX-XXXX-1234.

Read more: Static Data Masking

Database redaction

Database redaction masks every sensitive value in a database copy with placeholder characters while keeping field lengths and formats. It suits users such as DBAs who need the database structure, not the real values.

Read more: Dynamic Data Masking

Suppression

Suppression removes a sensitive value entirely, such as replacing it with a blank or null.

Read more: Static Data Masking

Generalization

Generalization replaces a precise value with a broader one, such as replacing a date of birth with an age band or a full address with a city.

Read more: Static Data Masking

Randomization

Randomization replaces a value with a random value of the same type and format.

Read more: Static Data Masking

Context-preserving masking

Context-preserving masking produces realistic fictitious values that keep the meaning and relationships of the original data, such as a valid-looking address in the same region. It keeps masked data useful for application testing.

Read more: Static Data Masking

Format-preserving encryption (FPE)

Format-preserving encryption encrypts a value so the result keeps the original length and format, such as a 16-digit card number that stays 16 digits. Applications and database schemas keep working without changes, and authorized users can decrypt the value.

Read more: Static Data Masking

Tokenization

Tokenization replaces a sensitive value with a non-sensitive token that maps back to the original only through a secure process. Mage Data supports format-preserving tokenization so tokens fit existing fields.

Synthetic identities

Synthetic identities are complete fictitious people, with names, addresses and other details, used to replace real individuals while preserving demographic patterns in the data. Mage Data calls this capability Identities.

Referential integrity

Referential integrity means related records stay correctly linked across tables and systems after masking or subsetting. Mage Data masks the same value consistently everywhere it appears so joins and application logic still work.

Data subsetting

Data subsetting creates a smaller, representative slice of a production database for testing, while keeping related records intact. Mage Data's Intelligent Subsetting builds the subset from a single condition, such as customers over 60, and resolves related records automatically.

Test data delivery

Test data delivery is how protected data reaches the teams and systems that need it. Mage Data supports in-place masking, extract-mask-load pipelines, automated file masking and self-service uploads, so it fits an organization's existing process.

Secure data provisioning

Secure data provisioning delivers protected data to the people and systems that need it, at scale and on demand. Mage Data provisions data through high-speed secure data pipelines, database virtualization, files in transit and self-service.

Secure data pipelines

Secure data pipelines move data from production to non-production or analytics systems and protect it in flight, so sensitive values never arrive unmasked. Mage Data's pipelines move millions of records in minutes.

In-place masking

In-place masking protects an existing copy of a database directly, such as a clone or staging environment.

Read more: Static Data Masking

Extract-Mask-Load (EML)

Extract-Mask-Load moves data from a source to a target and masks it in transit, so sensitive data never lands unprotected at the destination. Mage Data supports like-to-like and cross-platform moves, such as Oracle to Snowflake or a table to a CSV file, and can subset the data on the way.

Secure File Gateway (files in transit)

A Secure File Gateway watches folders and cloud storage locations such as Amazon S3, Azure Blob Storage and Google Cloud Storage, then automatically detects, masks and forwards files that land there.

File watchdog

A file watchdog continuously monitors folders and cloud storage for new or changed files and triggers protection automatically. Mage Data's file watchdog detects sensitive data in each file as it lands, masks it and forwards the protected file, with no manual step.

Self-service data provisioning

Self-service data provisioning lets developers and testers get protected data themselves, through a portal or file upload, without filing a request and waiting for a DBA.

Synthetic data generation

Synthetic data generation creates artificial data that mirrors the structure and statistical patterns of real data without containing any real records. Mage Data generates schema-based or digital twin datasets, synthetic documents and multi-turn conversational data for testing, development and AI training.

Differential privacy

Differential privacy is a mathematical technique that adds carefully calibrated noise to data or results so that no single individual's information can be inferred. Mage Data applies differential privacy when generating synthetic data.

Digital twin (data)

A data digital twin is a synthetic replica of a production dataset that keeps its structure, relationships and statistical patterns but contains no real records.

Control access

Dynamic Data Masking (DDM)

Dynamic data masking masks sensitive data in real time as it is queried, based on who is asking, without changing the data stored in the database. For example, a support agent might see j*******@****.com while an authorized manager sees the full email address.

Read more: Dynamic Data Masking

Role-based access control (RBAC)

Role-based access control grants or limits access to data according to a user's role, such as developer, analyst or administrator. Mage Data uses roles to decide which users see masked or unmasked data.

Read more: Dynamic Data Masking

Attribute-based access control (ABAC)

Attribute-based access control decides access using attributes of the request, such as the user, location, IP address, time of day or the tool being used. Mage Data's dynamic masking rules can combine these attributes.

Read more: Dynamic Data Masking

Column-level masking

Column-level masking protects every value in a chosen column, such as all national ID numbers in a customer table.

Read more: Dynamic Data Masking

Conditional (row-level) masking

Conditional masking masks values only in rows that meet a condition, for example masking customer details only for customers in a particular country.

Read more: Dynamic Data Masking

Row-level filtering

Row-level filtering hides entire rows from users who should not see them, so each user sees only the records they are entitled to.

Read more: Dynamic Data Masking

Database firewall

A database firewall blocks unauthorized connections to production databases using rules based on IP address, program or role, rather than masking the results. Mage Data's database firewall works alongside dynamic data masking as an enforcement control.

Database Activity Monitoring (DAM)

Database activity monitoring records and analyses who connects to a database, what they query and which sensitive data they touch. Mage Data's activity monitoring gives real-time visibility into sensitive data access and sends rule-based alerts by email or to a SIEM.

Read more: Database Activity Monitoring

Security Information and Event Management (SIEM)

A SIEM is a system that collects and analyses security events from across an organization. Mage Data sends activity monitoring alerts to SIEM tools such as IBM QRadar and Splunk.

Read more: Database Activity Monitoring

Audit trail

An audit trail is a time-stamped record of who accessed which data, when and how. Mage Data's activity monitoring provides the audit trail regulators and auditors ask for.

Read more: Database Activity Monitoring

Continuous compliance

Continuous compliance keeps data protection policies enforced at all times rather than checking them only during audits. Mage Data uses automated watchdogs to make sure protection policies stay enforced across the entire data estate.

Attack surface reduction

Attack surface reduction limits the places and people through which sensitive data can be exposed. Masking non-production data and restricting production access shrinks the attack surface.

User and Entity Behavior Analytics (UEBA)

UEBA uses machine learning to spot unusual behavior, such as a user suddenly reading far more records than normal. Mage Data applies UEBA-based anomaly detection to activity monitoring.

Read more: Database Activity Monitoring

Universal Policy Management

Universal Policy Management lets administrators set a high-level access policy once, such as "developers accessing production see redacted data", and applies it across every connected database automatically.

Application-level data masking

Application-level data masking protects sensitive data inside packaged business applications, at the screen and field level. Mage Data provides dedicated masking for Oracle PeopleSoft and Oracle E-Business Suite and SAP.

Read more: Dynamic Data Masking

SaaS data masking

SaaS data masking protects sensitive fields in cloud applications according to each user's profile. Mage Data's dynamic masking for Salesforce offers field-level masking more granular than native controls.

Read more: Dynamic Data Masking

Automate compliance

Citizen Mapping (Citizen Map)

Citizen Map is Mage Data's capability for locating every place a specific individual's personal data is stored, down to the record level. It helps organizations answer data subject requests and prove where personal data lives.

Data subject

A data subject is the individual a piece of personal data is about, such as a customer, patient, student or employee.

Read more: GDPR compliance

Data Subject Request (DSR)

A data subject request is an individual's formal request to access, correct, delete or move their personal data, a right granted by laws such as GDPR and DPDP. It is also called a data subject access request (DSAR).

Data subject rights

Data subject rights are the rights privacy laws give individuals over their personal data, including the right of access, the right to rectification (correction) and the right to erasure (deletion). Organizations must fulfill these requests within legal deadlines.

Read more: GDPR compliance

DSR fulfillment (DSR automation)

DSR automation handles data subject requests end to end, from intake and identity verification through to fulfillment and deadline tracking. Mage Data automates DSR fulfillment from intake to completion, with identity verification and workflows for access, erasure and rectification requests.

Data retention policy

A data retention policy defines how long each type of data may be kept before it must be deleted or retired. Mage Data applies retention policies by data classification and data store.

Read more: GDPR compliance

Legal hold

A legal hold suspends normal deletion of specific data because it may be needed for litigation, investigation or audit.

Data purge

Data purge is the automated, permanent deletion of data once its retention period ends.

Read more: GDPR compliance

Data retirement

Data retirement takes data out of active use while it still has to be kept. Mage Data retires data through tokenization, with a time-limited window in which it can be restored.

Read more: GDPR compliance

Crypto-shredding

Crypto-shredding makes encrypted or tokenized data permanently unreadable by destroying the keys needed to recover it. Mage Data uses crypto-shredding to make data retirement final.

Specialized topics

Database virtualization

Virtual database copy

A virtual database copy is a fully working database for a developer or tester that shares stored data with other copies and records only its own changes. Mage Data delivers virtual copies in a few minutes and uses up to 90 percent less storage.

Read more: Database Virtualization

Golden copy (golden snapshot)

A golden copy is the single, trusted base snapshot from which virtual copies are created. In Mage Data the golden snapshot is masked when it is created, so every copy made from it is compliant from the start.

Read more: Database Virtualization

Privacy-first virtualization

Privacy-first virtualization builds data masking into the virtualization process itself rather than adding it afterward. It ensures no virtual copy ever contains real sensitive data.

Copy-on-write (delta storage)

Copy-on-write is a storage technique where each virtual copy stores only the blocks it changes, while unchanged data stays shared. It is what makes virtual copies fast to create and cheap to store.

Read more: Database Virtualization

Test data catalog

A test data catalog is a library of approved, ready-to-use datasets that teams can provision on demand. In Mage Data, administrators publish masked master datasets to the catalog for self-service use.

Read more: Database Virtualization

Flashback (save point and restore)

Flashback lets a tester save the state of a virtual database and return to it later. It makes destructive or repeated tests easy to rerun.

Read more: Database Virtualization

Automated expiry

Automated expiry removes virtual copies automatically after a set date, such as the end of a project ticket, so unused environments do not pile up.

Read more: Database Virtualization

Time travel

Time travel provides virtual copies of data as it existed on a specific earlier date, which helps reproduce production issues.

Read more: Database Virtualization

Data branching

Data branching lets developers create their own version of a dataset, change it, and publish it back for others to use.

Read more: Database Virtualization

Data security and privacy for AI

Data Security and Privacy for AI

Data security and privacy for AI is the set of controls that keep sensitive data safe when it is used to train AI models, entered into AI tools, or returned by AI agents. Mage Data groups these controls into training data, usage, development, masking and monitoring guardrails.

AI guardrails

AI guardrails are controls that limit what data an AI system can receive, use or reveal. They reduce the risk of sensitive data leaking through prompts, training data or model responses.

Training Data Guardrails

Training Data Guardrails discover and mask sensitive data in structured and unstructured datasets, at rest or in flight within the data pipeline, before they are used to train or fine-tune an AI model.

AI Usage Guardrails (Guardrails for AI Usage)

AI Usage Guardrails detect sensitive data in the prompts and file uploads employees send to public generative AI tools such as ChatGPT, Gemini or Claude. Delivered as a browser extension and endpoint agent, they offer to mask the data and record a violation if the user overrides, rather than blocking work.

AI usage control

AI usage control is the industry term for governing how employees use AI tools and what data they share with them. Mage Data's AI Usage Guardrails address this category.

AI Development Guardrails

AI Development Guardrails give developers SDKs and MCP tools to build authorization checks and data masking directly into the AI agents and applications they create.

Model Context Protocol (MCP)

The Model Context Protocol is an open standard that lets AI agents connect to external tools and data sources. Mage Data provides MCP tools so agents can check permissions and mask data before showing it.

Dynamic Data Masking for AI (Guardrails for AI Runtime)

Dynamic Data Masking for AI sits between an AI agent and the language model and masks responses according to the human user behind the agent. It protects data in AI agents an organization did not build and cannot modify.

Activity Monitoring for AI

Activity Monitoring for AI audits how AI tools are used, including sensitive data in prompts and uploads and the use of unapproved AI tools, and reports violations.

Prompt data leakage

Prompt data leakage happens when users paste or upload sensitive information into AI tools, where it may be stored, logged or used for training outside the organization's control.

Shadow AI

Shadow AI is the use of AI tools that an organization has not approved, which can expose sensitive data without oversight.

Privacy regulations and compliance

Four imperatives of data privacy

The four imperatives are Mage Data's framework for complying with any privacy law: know your data, eliminate unnecessary data, control access, and automate compliance. Each regulation's requirements map onto these four steps, and each step maps onto platform capabilities.

Regulatory compliance

Regulatory compliance is meeting the legal requirements for protecting personal and sensitive data, such as GDPR, HIPAA, PCI DSS and DPDP. Mage Data lets organizations run one privacy program that covers any regulation by applying the four imperatives.

Personally Identifiable Information (PII)

PII is any information that can identify a person on its own or combined with other data, such as a name, email address, phone number or national ID number.

Protected Health Information (PHI)

PHI is health information linked to an identifiable person, such as medical records or insurance details, and is protected in the United States under HIPAA.

Payment card data

Payment card data is cardholder information such as card numbers and expiry dates, which must be protected under the PCI DSS standard.

Data minimization

Data minimization is the principle of collecting, keeping and exposing only the personal data needed for a specific purpose. Masking non-production copies applies data minimization to development and testing.

Privacy by design

Privacy by design means building data protection into systems and processes from the start rather than adding it later.

Cross-border data transfer

A cross-border data transfer moves personal data from one country to another, which many privacy laws restrict. Masking or anonymizing data before it leaves a country can make sharing possible.

Read more: GDPR compliance

HIPAA

The Health Insurance Portability and Accountability Act is the United States law that sets standards for protecting health information.

PCI DSS

The Payment Card Industry Data Security Standard is the security standard that organizations handling payment card data must follow.

CCPA / CPRA

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over the personal information businesses hold about them.

DPDP Act

India's Digital Personal Data Protection Act, 2023 governs how organizations process the digital personal data of individuals in India.

PDPL (Saudi Arabia)

Saudi Arabia's Personal Data Protection Law regulates the collection and processing of personal data in the Kingdom.

PDPPL (Qatar)

Qatar's Personal Data Privacy Protection Law sets rules for processing personal data in Qatar.

POPIA

South Africa's Protection of Personal Information Act regulates how personal information is processed in South Africa.

NDPA

Nigeria's Data Protection Act, 2023 establishes rules and a regulator for personal data protection in Nigeria.

Kenya Data Protection Act

Kenya's Data Protection Act, 2019 regulates the processing of personal data in Kenya and the rights of data subjects.

Ready to secure your data?

Join hundreds of enterprises that trust Mage Data for their security and compliance needs.

Get Started Try It Now