A native Polars plugin that masks sensitive data inside your pipeline — zero rows leave your infrastructure, zero Python overhead per row.
Built for engineers who can't afford cloud vendors in their data path — or simply don't want them there.
No network calls, ever. Runs offline, in CI, behind firewalls, inside VPCs. Your data never touches an external server — by architecture, not by policy.
FPE mode (FF3-1 AES-256) produces reversible pseudonymization under GDPR Art. 4(5). Same format, different value, decryptable only with your key — which MaskOps never sees.
RUT (Chile), CPF (Brazil), CURP (Mexico), IBAN, VAT, EU national IDs, email, phone, IP, credit cards. Built for the regulatory landscape of today's data-driven business.
Compiles to a native .so that Polars loads as an expression plugin. Zero Python overhead per row. Parallelism via Rayon, automatic.
contains_pii tells you if a column has PII before you mask it. Useful for audits, schema validation, and compliance checks in existing pipelines.
Each pattern declares its regulation, compliance category, and validation logic. Suitable for CMF NCG 311, ISO 27001, and SOC 2 auditor documentation.
import polars as pl import maskops # 32-byte key + 7-byte tweak — stays with you key = pl.lit(bytes.fromhex("a1b2c3...")) tweak = pl.lit(b"season1") df = pl.read_parquet("transactions.parquet") # pseudonymize — format preserved, reversible masked = df.with_columns( maskops.mask_pii_fpe("rut", key, tweak), maskops.mask_pii_fpe("phone", key, tweak), ) # 12.345.678-9 → 87.162.043-5 (reversible) # +56 9 8765 4321 → +56 9 2341 8907
Pseudonymized data — where re-identification requires a separately-held key — still falls under GDPR, but with significantly reduced risk and lighter compliance burden. Under Art. 32, pseudonymization is an explicitly recommended security measure. MaskOps FPE mode is a direct technical implementation of that requirement. The key stays with you. The regulator is satisfied. Your analytics team keeps working.
On the cryptography: FF3-1 is proposed for deprecation in NIST's draft SP 800-38G Rev.1. We document the status, our mitigations, and the FF1 migration path openly — read the security note →
PII identifiers matched to the regulation that makes them sensitive.
Start with a free 3-week pilot. Convert to a retainer when you're ready. No procurement committees, no annual lock-in.
Available to the first 10 clients only.
Your rate never increases — ever.
Not sure yet? Start with a free 3-week integration. MaskOps integrated into one Polars pipeline, masking rules configured for your PII types, pytest coverage included, and a one-page compliance summary for your legal team — at no cost. All we ask: a short debrief call and a LinkedIn testimonial if it works.
pip install maskopsimport maskopsimport polars as pl import maskops df = pl.DataFrame({ "rut": ["12.345.678-9", "9.876.543-2"], "email": ["user@company.cl", "admin@corp.io"], "phone": ["+56987654321", "+5621234567"], }) masked = df.with_columns( maskops.mask_pii("rut"), maskops.mask_pii("email"), maskops.mask_pii("phone"), )
Book a 15-minute call to discuss a free pilot. No procurement process, no deck.