Scan for PII, then mask what it finds

Masking works well once you know which columns hold personal data. Finding them across a schema you inherited is the slow part.

Scan for PII reads your schema and flags the columns that look like personal data (emails, names, phone numbers, addresses, and similar), then proposes a masking rule for each one. You review the list and apply what you agree with. It is a starting point you edit, not a decision made for you.

Masking itself is unchanged: a column can be redacted, nulled, or hashed in flight. Masked values still join and group correctly, so an agent can run GROUP BY email and get honest counts without ever seeing an address. Hashing is the mode to reach for when you need the same input to produce the same value across queries.

The audit surface also picked up filters, per-row detail, and CSV export in the same release.