> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# About Data Masking

This article explains how data masking works when you restore a database in Eon.

Data masking replaces the values in columns that Eon classified as sensitive while it restores a database.
Without masking, giving developers or testers a realistic copy of a production database means exposing real customer data.
With masking, you restore the backup into a development or test environment and the sensitive values are already replaced.

## What Eon masks

Eon masks the columns that [data classification][resource classifications] tagged with a [data class][data classes], such as PII, FI, or PHI.
Eon uses the resource's latest classification results, not the results from when the snapshot was taken.

Masking changes values only, not the column type.
Null values stay null.
Replacement text is never longer than the original value, so a masked one-character value becomes `*`.

> **Warning**
>
> Masking covers only the columns that classification identified.
> Data masking is available for snapshots stored in [Eon vaults][about-vaults] only.
> Check the restored data before you share it.

## Replacement methods

When you restore, you choose one of the following replacement methods.
The replacement value depends on whether the value is a text value or another data type:

| Method                         | Text values              | Other values                                                              |
| ------------------------------ | ------------------------ | ------------------------------------------------------------------------- |
| **Use fake data**              | Replaced with fake names | Replaced with random values of the same type                              |
| **Mask with asterisks \*\*\*** | Replaced with `***`      | Replaced with zero or empty values, such as `0`, `false`, or `1970-01-01` |

With **Use fake data**, the same original value always gets the same fake value within a restore, so joins between masked columns still match.

## Additional information

* [RDS: Restore an Instance][rds-restore-an-instance]

* [Resource Classifications][resource classifications]

* [About Classification Policies][about-classification-policies]

[resource classifications]: /data-protection/backup-and-protection/backup-management/classifications/resource-classifications

[data classes]: /data-protection/backup-and-protection/backup-management/classifications/resource-classifications#data-classes

[about-classification-policies]: /data-protection/backup-and-protection/backup-configuration/classification-policies/about-classification-policies

[about-vaults]: /data-protection/backup-and-protection/backup-configuration/vaults/about-vaults

[rds-restore-an-instance]: /data-protection/restoring/restore-cloud-workloads/aws/rds-and-aurora/rds-restore-an-instance