For Salesforce Admins
You Know There's PII in Your Sandboxes.
Every refresh copies production. You've been clearing a few obvious fields manually, with no audit trail, and no way to prove it was done right. DataMasker automates the entire masking profile, logs every run, and gives you a clean answer when the auditor asks.
Your Day
Three Compliance Scenarios Admins Own Every Day
Legal just forwarded a GDPR deletion request. It's been 15 days.
BEFORE CC
You're manually identifying every Contact, Case, Activity, and custom object that holds this person's data. You're emailing each system owner. You're trying to remember which custom objects have lookup relationships to Contacts. The 30-day GDPR deadline is approaching.
AFTER CC
Privacy Rights Automation handles the intake form, identity verification, cascade deletion sequence, and generates a GDPR-compliant audit report. You review and approve. Total admin time: 15 minutes.
The CTO just asked: 'Why do our developers have access to real customer emails in the sandbox?'
BEFORE CC
You know this is a problem. Every sandbox refresh copies production. You've been manually clearing a few obvious fields. But you know you're missing things, and you have no audit trail.
AFTER CC
DataMasker runs automatically after every refresh. All PII fields are replaced with realistic fake data. You review the masking summary report. The CTO gets a clean answer. And an audit log.
Finance flagged that your Salesforce storage is at 90%: mostly old records.
BEFORE CC
You know some records should be deleted but you don't know which, who owns the decision, or how to document compliance with GDPR's data minimization requirement. Manual deletion at scale is error-prone.
AFTER CC
Data Retention Manager evaluates records against your configured policies: 7 years for financial data, 3 years for marketing leads, 2 years for inactive contacts. Automated deletion runs on schedule. Finance sees storage drop. Legal sees a retention log.
Configuration
Point-and-Click Configuration
DataMasker masking rules
Field-by-field configuration via a table UI in Salesforce
Sandbox masking profiles
Save different masking configs for dev vs QA vs UAT sandboxes
Data Retention policies
Create policies by object type, age threshold, and jurisdiction
Privacy Rights workflows
Configure the request intake form, verification steps, and deletion sequence
Key Takeaways
Declarative masking rules configured in UI, no Apex code required to set up or modify policies
Sandbox refresh trigger: DataMasker runs automatically, admins never need to remember to run it
DSAR workflow managed entirely in Salesforce, no external tools, no CSV exports required
Retention policy UI: pick object, field conditions, retention period, runs on schedule
Audit log visible in Salesforce, admins can see every masking run, deletion batch, and DSAR event
Implementation supported: guided onboarding over Zoom, CC team never accesses your org directly
“I configured DataMasker without touching a single line of code. The masking rules are in a table. I just chose the fields and the substitution type. Took about two hours to set up the whole sandbox masking profile.”
Salesforce Admin, Swiss Construction Enterprise
Frequently Asked Questions
No. All three CC products - DataMasker, Data Retention Manager, and Privacy Rights Automation - are configured entirely through Salesforce screens. Masking rules are set via a field configuration table. Retention policies are created as Salesforce records. Privacy rights workflows are built with screen flows. Zero Apex required for standard implementations.
DataMasker can be triggered manually from the Salesforce UI or automatically via REST API post-refresh. For automatic triggering, your org's DevOps pipeline (Copado, Gearset, or a simple connected app) calls the DataMasker REST endpoint after the sandbox refresh completes. If your team doesn't use a pipeline tool, CC provides a scheduling option within Salesforce. No code needed.
Privacy Rights Automation has configurable exception rules. You define which record conditions block deletion: active contract status, open case status, litigation hold flags. When the system encounters an exception, it logs it, notifies the request handler, and applies partial anonymization instead of full deletion where appropriate. You review exceptions before they're processed. The system doesn't delete anything without your review.
CC generates audit documentation automatically. DataMasker masking jobs create a log record with: which sandbox was masked, when, which masking profile was used, and field-level statistics. Privacy Rights Automation creates a complete request log with timestamps for every step. Data Retention Manager logs every deletion cycle. Export these logs as reports for auditors. No manual reconstruction needed.
DataMasker uses a declarative rule builder in Salesforce. From the DataMasker app, admins navigate to Masking Rules and create a new rule: select the object (Account, Contact, custom), select the field, and choose the masking type, substitute, nullify, scramble, or mask. Rules can have filter conditions so only certain record types or field values are masked. Once rules are saved, they execute automatically on the next sandbox refresh. There is no Apex code to write or deploy. For complex scenarios, the Cloud Compliance implementation team provides guided configuration during onboarding.
DataMasker integrates directly with Salesforce's sandbox refresh lifecycle. Once configured, the masking job is triggered by the refresh event, it does not depend on a manual admin action. If a refresh completes and masking has not yet run, the sandbox is in a queued state and the admin receives a notification. In sandbox environments where Salesforce Shield Encryption is active, DataMasker operates on the decrypted field values during the masking window and re-encrypts after. The sandbox is not available for developer access until masking is confirmed complete, preventing inadvertent PII exposure during the window.
What Admins Do Next
How DataMasker Works
Point-and-click masking rule configuration. No Apex. Runs on every sandbox refresh automatically.
DataMasker vs. Data Seeding Tools
Why masking beats seeding for GDPR/HIPAA compliance: native Salesforce, no external cloud.
Customer Case Studies
How admins at PenFed and European Insurance Company implemented DataMasker in 3 weeks.
See the admin interface in action
30-minute demo. We'll walk through configuring masking rules, retention policies, and privacy rights workflows: all point-and-click