Masking

Value-discovery mode and KEY_N masking-session contract.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Step-by-step actions

Open Masking and record the current mode.
Choose Automatic or Verdict classes only, then Save.
Refresh and compare mode, auto_discover and request_override.
Send a synthetic email through your protected integration; verify replacement before upstream and response restoration where supported.
Restore the previous mode and save to revert.

Every control and its meaning

Control / parameter	Values, units and effect
auto / verdict_classes	auto adds sensitive-value discovery; verdict_classes replaces verdict classes. This selects masking behavior rather than disabling all protection.
iam_masking / X-IAM-Masking-Mode	Per-request override works only when allowed by the gateway. Check request_override and supported headers in the table.
Session backend / encrypted / TTL	Where/how replacement mappings are stored and their lifetime in hours. Read-only table; the operator configures Redis/encryption/TTL.
Сохранить / Refresh	Save acknowledges the shared Redis mode; Refresh rereads it. The hosted setting survives gateway restart. Without Redis it is process-local; Redis backup is configured separately.
settings_backend	redis stores the shared mode without TTL; memory is local to one process. This setting backend is separate from session_backend for replacement mappings.

Verify the result

A saved mode does not prove maskable spans or reversible FPE. Check request ID, replacement receipt and response; never expose customer secrets in documentation. Compare mode and settings_backend across replicas; a Redis failure does not acknowledge a save, and serving falls back to stricter auto discovery.

Errors, disabling and reverting changes

An expired/lost mapping may prevent restoration. Ask the operator about Redis/TTL/encryption; changing mode does not automatically migrate sessions between replicas.

**Saved masking mode · isolated staging**
2026-10-15 · Actual isolated Kubernetes staging with owned PostgreSQL/Redis and a synthetic customer. verdict_classes was saved through the UI and read on both replicas, then auto was restored through the UI. Shared customer settings were unchanged. Unretouched original pixels; this frame does not qualify every replacement class.

Detailed security settings · Traffic analysis · FAQ · All application sections