Data protection
Column-level security and masking
Autessa column-level security lets each AutessaDB role see a column in full (VISIBLE), transformed (MASKED with REDACT, LAST_FOUR or HASH) or not at all (HIDDEN), and decide whether that role may write it. Masked text columns can be stored encrypted, and every reveal of a masked value is recorded in the access log.
The problem
What problem does it solve?
The people who need a record rarely need every field on it. A support agent needs the customer’s name, not their full bank account; a dashboard needs a stable ID, not a tax number.
How it works
- 1
Add column rules to a role
For each column choose VISIBLE, MASKED or HIDDEN. Columns without a rule are fully visible and writable.
- 2
Pick a mask
REDACT replaces the value entirely, LAST_FOUR shows only the last four characters, HASH shows a stable hash.
- 3
Control writes
Set writable per column, so a role can see a field without changing it.
- 4
Store it encrypted
Mark a text column masked at creation to store it encrypted at rest; callers whose role allows it can reveal values, and each reveal is logged.
Every option
Column-level security and masking: settings and options
| Setting | What it does |
|---|---|
| VISIBLE | The full value. |
| MASKED | REDACT, LAST_FOUR or HASH. |
| HIDDEN | Dropped from the schema and results. |
| writable | Defaults to true. |
| masked column | SHORT_TEXT or LONG_TEXT stored encrypted at rest. |
Permissions
Who can do what?
| Who | What they can do |
|---|---|
| Table Admins | Write column rules and use hidden columns inside row rules. |
| Callers with a masked or hidden column | Cannot filter, sort, group, aggregate, join or search on it. |
What to know
- Table security is opt-in: a masked column needs an explicit role rule to hide it.
- Legacy API keys with no owner always get “••• masked” for protected fields.
Connections
How Column-level security and masking connects to the rest of Autessa
Reports, policies and security questionnaires are on the Autessa Trust Center.
FAQ
Column-level security and masking: questions
Can I show only the last four digits of a field?
Yes. Set the column to MASKED with LAST_FOUR for that role.
Can someone sort by a column they cannot see?
No. Filtering, sorting, grouping, aggregating, joining or searching on a hidden or masked column is refused with “You don’t have access to column name.”
Is masked data encrypted?
Text columns created as masked are stored encrypted at rest and shown as mask text unless the caller’s role allows revealing them.
Get started with Column-level security and masking
Autessa includes column-level security: each role sees a column in full, masked (redacted, last four or a stable hash) or not at all, and masked columns can be stored encrypted.
Reports, policies and questionnaires live on the Autessa Trust Center.
100% customizable, code and all
Make Autessa Security & Compliance fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours