DATA MASKING & PII
Let agents reason over your data without seeing what they shouldn't.
Account confidentiality and fixed privacy controls determine which names, memos, and protected transaction detail a governed response may contain.
Useful analysis needs structure and relationships, not real names. Most tools force a choice between sharing everything or nothing. PipeLedger applies one clear policy at query time – the model gets what it needs, not what it shouldn't have.
Three clear account levels. One enforcement contract.
Click 'Admin re-identify' in the diagram below to see how a token resolves under role-gated, logged access.
| VENDOR_NAME | AMOUNT |
|---|---|
| John Smith | $145,000.00 |
| Sarah Johnson | $98,500.00 |
| Riverside Lumber | $234,100.00 |
| Pacific Ventures | $67,200.00 |
| VENDOR_NAME | AMOUNT |
|---|---|
| CUST_8F4KQ2A1 | $145,000.00 |
| CUST_3B7PQ9R2 | $98,500.00 |
| VEND_2A9MK5P1 | $234,100.00 |
| CUST_7H2LN5K8 | $67,200.00 |
Amounts pass through unmasked — agents reason on the numbers and keep ledger integrity; only the identity is tokenized.
Standard keeps permitted transaction columns. Restricted removes identifying columns while retaining the financial line. Highly Restricted removes transaction grain and returns only ledger totals with the minimum accounting context needed to interpret them; dimension scope still limits which rows contribute. Mark a Highly Restricted account amount confidential and it is left out of every below-clearance result, with ledger controls reported not applicable.
Replace Customer, Vendor, Employee, or Project identity with stable private tokens globally or for one account. Memos can be prohibited absolutely, with no credential override.
Rate-limited, role-gated, and recorded in the append-only audit trail before an approved token resolves to an original value.