Fleak joins the Databricks startup accelerator. See the announcement

Mask PII in flight. Before anything downstream sees it.

Fleak finds emails, phone numbers, SSNs, card numbers, IP addresses, secrets, and your own patterns in every event, then masks, hashes, encrypts, or quarantines them before any destination receives a copy.

Book a demo See how it works
  • PII
  • PCI
  • PHI
  • Secrets
  • Custom patterns
  • Quarantine

Logs carry more personal data
than anyone signed off on.

Usernames in URLs, card numbers in error messages, API keys in debug output. Every copy downstream widens the exposure.

PII hides in free text

Sensitive values turn up in message bodies, query strings, and stack traces, not only in fields named email or ssn.

Every destination is another copy

The SIEM, the lake, the archive, and now the AI agent each keep a copy. Redacting in one of them leaves the others exposed.

Dropping fields destroys context

Deleting a whole field to remove one value strips out the context an investigation depends on.

Sensitive values protected,
context kept.

Detection and masking run in the pipeline, upstream of every destination. You choose the fields, the detectors, and what happens to each match.

Built-in detectors

Email, phone number, SSN, credit card, IPv4, and IPv6 detectors run against every field you target, including every nested string under a wildcard path.

Discovery you didn't configure

The Brain samples traffic for sensitive data no rule covers yet, such as a new field carrying credentials, and proposes a rule for your review.

Mask, hash, encrypt, or drop

Replace a match with a token, hash it to keep it joinable, encrypt it for authorized recovery, or remove the field entirely.

Your own patterns

Add named patterns for API keys, account numbers, or internal IDs, each with its own replacement token such as [API_KEY].

Quarantine instead of leak

Route events that carry sensitive data to a restricted destination for review instead of the shared SIEM.

Built for your compliance program

Mask once, before the pipeline branches, so every destination holds the same clean event. Evidence for GDPR, CCPA, HIPAA, and PCI DSS reviews.

Cleartext credentials caught

Passwords, tokens, and keys that applications log in clear text are detected and masked before they reach a single destination.

Mask at the edge

Apply masking on the host or site where data is produced, so regulated values such as PHI never cross the network unprotected.

Residency by policy

Route personal data to in-region storage and keep the rest global, with policies per region, tenant, or data class.

Mask it before it multiplies.

One node, upstream. Every SIEM, lake, archive, and agent receives the protected event.

Read the docs Book a demo

Masked once.
Clean everywhere downstream.

Masking runs as a deterministic node before the pipeline branches. Every destination receives the same protected event, and the original value never leaves the pipeline.

Masked before it reaches

  • Splunk
  • Microsoft Sentinel
  • Databricks
  • Amazon S3
  • AI agents

A billing error log lands with customer data in the message.
What does each destination see?

Raw

Exposed

A customer's email, a card number, and a live API key sit in the message body. Every downstream copy holds all three.

Masked

In flight

The email is hashed so it still joins, the card number and the key are masked. The rest of the message, and its context, is intact.

Trust model

Deterministic

The same input is masked the same way every time, and every rule is reviewed before it ships.

Mask upstream, once. Every destination downstream, including the AI agents reading your telemetry, inherits it.

"The safest copy of a sensitive value is the one that never gets made. Mask in flight, before the first destination."

Sensitive data · Fleak Platform

Bring the log source you're nervous about.

30-minute working session. We'll mask it live on sample events.

Read the docs Book a demo

Explore Related

Pipeline lifecycle

Test, version, and roll back

Pipelines built and shipped like software.

See Detail →
Routing

Route every log by what it's for

SIEM, lake, and archive, each in its own schema.

See Detail →
Log reduction

Less volume, same coverage

Filter, trim, deduplicate, sample, and aggregate in flight.

See Detail →