Field Masking and Export

If the source datastore contains masked fields, the platform applies the masking policy before the exported data leaves the platform. This page explains exactly what gets masked, what does not, and how to opt out per export.

What gets masked

Field masking only affects histogram values inside Field Profile exports.

• Field Profile exports: in the histogram_buckets column, the bucket value for any field under field masking is replaced with a sentinel placeholder so the statistical distribution of sensitive values is not exposed.
• Anomaly exports and Quality Check exports are not affected by field masking. They don't contain raw field values.

Where the masking is applied

Masking is applied by the platform before the export payload is sent to the dataplane for writing. The enrichment datastore always receives already-masked data for any fields designated as sensitive. The dataplane, the network hop in between, and the enrichment datastore never see the unmasked values for masked fields when masking is in effect.

How to reveal masked values

Two ways to opt out per export:

• In the Export Operation modal: when you select Field Profiles as the asset type, a Reveal Masked Values toggle appears. Turn it on to include the raw histogram values in the exported table.
• Via the API: pass include_masked: true on the POST /operations/run request. See API for the full request shape.

The toggle defaults to off. Revealing masked values requires the Editor team permission on the source datastore.