Data Mask & Seed Needs an Add-On Licence Too. Here's What You're Actually Paying For.

Salesforce does not publish a price for Data Mask & Seed. Its documentation says the app is available "with the Salesforce Data Mask add-on license" and that each user needs the "Data Mask And Seed User" permission set licence — the same licensing model as the retired managed package, which needed the Data Mask (Legacy) add-on. So "how much does it cost" is a conversation with your account executive. This article is about the better question: what should a sandbox masking licence buy you, and which of those things does the built-in tool cover?

Built in is not the same as included

The confusion is understandable. Data Mask & Seed arrived in the Summer '26 release as a Core application: nothing to install from AppExchange, a tab in Setup, policies you build in the app. Salesforce's knowledge article on the managed package's end of support describes it as "available to all customers". That describes how it is delivered.

The licensing page describes what it costs to use: Professional, Enterprise, Unlimited and Developer Editions with the Salesforce Data Mask add-on license. To access the app, an admin assigns the Data Mask And Seed User permission set licence and then the matching permission set. A permission set licence is an entitlement your org has to own. No entitlement, no tab.

If your org already licensed the legacy Data Mask package, the one question that matters — and the one to get answered in writing — is whether that entitlement carries across to the new app, and for how many users. Do not assume either answer.

What a masking licence is actually buying

Strip the product names away and a sandbox masking licence is paying for six things. Score any tool, built in or not, against them.

1. Every sandbox you refresh, not a subset. Masking that covers two of your five sandboxes is a compliance gap with a licence attached. Check whether the entitlement is per org, per sandbox, or per user, and what happens when you add a Full sandbox.

2. Throughput at your volume. A Full sandbox of a mature org is tens of millions of records. Salesforce's documentation for Data Mask & Seed sets its guarantees by job size: a job is capped at 350 million records, and above 20 million records the app no longer preserves data distributions or applies consistent masking across objects. DataMasker sustains three to five million records per hour and has masked 99 million records in 24 hours. Know your record count before you compare anything.

3. Consistency you can test against. The same person's email masked to the same value on Contact, Lead and Case; value distributions that look like production so reports and integrations behave. Above the 20-million threshold, Salesforce documents that Data Mask & Seed provides neither. DataMasker masks in place, so record IDs and parent–child relationships hold by construction.

4. Cleanup of everything a refresh copies besides data. A refresh brings over live email addresses, remote-site settings pointing at production endpoints, scheduled jobs and integration credentials. Masking a field does nothing about a workflow that emails on update. This is the failure that produces the incidents — our most-read article is about a sandbox refresh that emailed real customers. Ask whether cleanup is part of the masking job or a checklist somebody is supposed to remember. DataMasker auto-updates remote-site settings and custom labels and deletes files, case comments and tasks in the same run.

5. A way to run it from where sandboxes are made. If a pipeline creates your sandboxes, masking has to be a step in that pipeline with a logged result. Salesforce's documentation describes running Data Mask & Seed from the app — manually, on a schedule, or on sandbox creation or refresh — and does not describe an external trigger. DataMasker exposes an API so masking runs from DevOps tooling.

6. Someone to call when a rule stops matching. A masking rule that quietly stops matching a renamed field does not throw an error; it leaves real data in a sandbox. Support for the managed package ended on 9 July 2026. For the new app, support comes with the Salesforce contract. DataMasker includes premium support and upgrades in its subscription.

The six questions for your account executive

1. Does our existing Data Mask entitlement carry across to Data Mask & Seed? For how many users? Confirm in writing.
2. Is the add-on licensed per org, per user, or per sandbox — and what does adding a sandbox cost?
3. What is the total record count of our largest Full sandbox, and is it above 20 million? (Ask yourself, then ask them what that means for consistency.)
4. How many masking jobs per day will our refresh cadence need across all sandboxes? The documented cap is 12 per sandbox per 24 hours.
5. Which objects in our org carry automations on Feed, History, Case Comment, Email Message or Chatter Comment deletes? Those do not bypass automations under Data Mask & Seed.
6. Who re-creates our masking policies, since they do not migrate from the managed package, and what does that work cost in hours?

Questions 3 to 6 are not about price at all. They are about whether the licence buys the six things above. That is the point.

What DataMasker costs, since we can say

DataMasker's list price is $4.99 per user per month, with premium support and future upgrades included and all compute running inside your Salesforce org — there is no external infrastructure to pay for. There is a free tier: unlimited records across any four Salesforce objects, with no expiry and no record cap, which covers many smaller orgs entirely. Full plan details are on the pricing page.

We are not going to put a number next to Salesforce's product, because Salesforce has not, and a guess is worse than a blank. What we will say is that the configuration work is being redone either way — policies do not migrate — so this is the one moment where evaluating an alternative costs nothing extra.

The short version

Data Mask & Seed is licensed, not free; Salesforce does not publish the price; and the entitlement question is whether your legacy licence carries across. Judge any masking licence by six things — sandbox coverage, throughput, consistency, post-refresh cleanup, pipeline integration and support — and use Salesforce's own limitations page to see where the built-in tool's guarantees end. DataMasker lists at $4.99 per user per month with a free four-object tier.

Sources

• Salesforce Help, Protect Sensitive Data with Data Mask & Seed — required editions ("with the Salesforce Data Mask add-on license")
• Salesforce Help, Data Mask & Seed Requirements and Limitations — permission set licence, record and concurrency limits, automation behaviour
• Salesforce Help, Data Mask Managed Package End of Support, knowledge article 005299299, updated 4 August 2026
• Salesforce Help, Secure Your Sandbox Data with Salesforce Data Mask (Legacy) — required editions ("with the Salesforce Data Mask (Legacy) add-on license")
• Cloud Compliance pricing page and DataMasker product pages