Data Governance & Masking

Context

My Spindox internship covered Data Governance and Data Masking. This technical case study describes a separate personal proof of concept using synthetic data; its results do not describe Spindox systems or internal work.

Problem

Masking sensitive identifiers one field at a time can break joins, constraints and cross-system consistency. Moving unprotected data into development or analytics environments increases exposure.

Goal

Inventory and classify PII columns, apply consistent pseudonyms across related relational data and check that the protected dataset retains the intended technical properties.

My responsibilities

I developed and documented the proof-of-concept repository: its CLI workflow, classification and masking rules, protected-database checks and automated tests. I do not describe internal company responsibilities or deliverables here.

Documented implementation

The local workflow generates synthetic data, inventories schemas and relationships, profiles and classifies fields, applies pseudonymization rules and validates the protected schemas. YAML policies are versioned; value mappings remain in memory during a batch.

Technical decisions and tradeoffs

• Consistency across tables

  Deterministic pseudonyms use an external key, normalization and namespaces. Approved technical keys remain stable to preserve relationships. This also retains linkability: the process is pseudonymization, not anonymization.

• Reviewing ambiguity

  Ambiguous classification does not trigger a guessed masking rule: execution requires an explicit decision. This adds manual work but makes the decision traceable.

Checks and verification

The repository documents tests for counts, constraints, cross-table relationships, consistency groups, schema drift and deterministic idempotence on the synthetic workload.

Documented evidence and results

• Synthetic inventory

  20 source and 20 protected tables; 109 columns inventoried and classified in the reference workload.

• Documented checks

  The repository suite checks relationships, constraints, absence of schema drift and deterministic idempotence on the synthetic dataset.

Limits and improvements

Validation covers synthetic data only. It does not establish real-data detection accuracy, enterprise performance or legal compliance. Authentication, operational secret management and production observability remain future work.

Technologies

• Python 3.12
• PostgreSQL 16
• YAML
• pytest