Agent Mask helps teams safely use sensitive data that already lives in Snowflake. It detects and de-identifies PII and PHI in support tickets, call transcripts, clinical notes, intake forms, chat logs, AI outputs, PDFs, DOCX files, images, and DICOM files.
Because Agent Mask runs as a Snowflake Native App, sensitive data stays inside the customer’s Snowflake account. There are no external APIs to send data to, no separate masking infrastructure to manage, and no copy-and-export workflow that creates more risk.
Teams can call Agent Mask directly from SQL to return de-identified output while keeping the original data intact. It supports multiple de-identification strategies, including typed placeholders, fixed redaction labels, character masking, hashing for analytics joins, encryption, synthetic replacements, and detect-only mode.
Agent Mask is especially useful for regulated analytics and AI workflows where teams need to preserve the value of unstructured data without exposing the people, identifiers, or protected details inside it. Identity-aware masking can keep references consistent across columns or long-form text, so “John Smith,” “John,” and “Dr. Smith” can resolve to the same placeholder when they refer to the same person.
Key Capabilities
Snowflake-native PII/PHI de-identification
Zero data egress from the customer’s Snowflake account
One SQL function for text and document masking workflows
Support for PDFs, DOCX, images, DICOM, and free-form text
Stable placeholders for analytics and join-preserving workflows
Custom entity detection for domain-specific IDs, terms, and records
Per-entity masking strategies for different compliance and analytics needs