Secure your sandbox data by using Salesforce's new Data Mask & Seed. Admins and dev teams can define Data Mask policies and use them to mask sensitive sandbox data, such as proprietary, restricted, government-regulated, and personally identifiable information (PII). The new Data Mask & Seed is a native Salesforce app and not a managed package. Being a native app, it requires no installation and the Salesforce platform automatically applies all necessary updates. Now generally available, Data Mask & Seed includes several new updates since its recent Beta release.
Where: This change applies to Lightning Experience in Developer, Enterprise, Essentials, Performance, Professional, Starter Suite, and Unlimited editions (all Lightning Experience editions). Data Mask & Seed is available for customer production use, including Government Cloud, in all Salesforce regions. Salesforce automatically redirects users to their closest Salesforce region.
When: Data Mask & Seed is generally available starting in mid-July 2026.
Who: To access and work with the new Data Mask & Seed application, assign users the following Permission Set License and Permission Set. Make sure to assign the Permission Set License before assigning the Permission Set:
- Data Mask And Seed User Permission Set License
- Data Mask and Seed User Permission Set
How: Data Mask & Seed is a native Salesforce app that requires no installation. In the App Launcher, search for and select Data Mask & Seed.
Work with Data Mask & Seed's Redesigned and Localized User Interface
Configure data masking tasks more easily with a redesigned, intuitive interface. The updated experience provides well-organized displays and clear messaging to simplify navigation and the configuration process for admins and developers. New for the app's generally available release, the localized UI is available in each of the Salesforce supported languages.
Detect Personally Identifiable Information Proactively
The new Data Mask & Seed automatically identifies object fields in masking policies that contain personally identifiable information (PII). During policy configuration, the feature provides a suggested Mask With option for these object fields. Suggesting Mask With options reduces the manual effort required to secure sensitive data in your sandbox environments. You can always modify the suggested Mask With option for an object field.
Consistent Field Masking Across Objects
Data Mask & Seed applies the same masking value to identical fields that are found across multiple objects in your masking policy. For this masking processing to be applied, all of the following conditions must be met:
- The masking job's total record count can't exceed 20,000,000 records.
- Identical fields across policy objects must share all of the following characteristics:
- Same Field Name (not Field Label)
- Same Data Type — for example, Email, Text, Date, Phone, LongText
- Same Mask With value (masking rule)
When a masking job exceeds 20,000,000 records, Data Mask & Seed runs the job, however, without applying the Consistent Field Masking Across Objects feature.
Preserve Existing Data Distributions in Your Sandbox
Data Mask & Seed analyzes the distribution of field values within an object's records during a sandbox masking job. In doing so, masking preserves the original frequency and proportion of field values across the records of each object. Developers work with realistic datasets that mirror your production data patterns while keeping sensitive information secure. For example, if 55% of your Contact records have the City value Abu Dhabi, 25% have the City value Tokyo, and 20% have the City value Nicosia, masking preserves that ratio of City values in the masked Contact object.
For this masking processing to be applied, the following condition must be met:
- The masking job's total record count can't exceed 20,000,000 records.
When a masking job exceeds 20,000,000 records, Data Mask & Seed runs the job but doesn't preserve existing data distributions in the sandbox.
Filter Object Records
New for the app's generally available release. In policies, use a filter to specify the subset of object records that you want masked. A policy filter contains one or more conditional statements that a masking job applies when evaluating which object records to mask. Data Mask & Seed provides you with several filter conditions or the ability to customize filter conditions by using logical operators.
Bypass Automations
New for the app's generally available release. At the start of masking jobs, Data Mask and Seed automatically bypasses Salesforce automations enabled for the sandbox. The affected automations are any custom workflow rules, triggers, validation rules, and automations from installed managed packages. You don't bother with manually disabling and reenabling these automations for the sandbox.
Get Precise Detail from Informative Masking Job Error Messages
Effectively troubleshoot masking jobs with error messages that provide precise details, including problematic record IDs and offending fields. Masking job error messages also include a link to documentation explaining common errors. By identifying specific records and fields that cause issues, you can immediately address data integrity problems in your sandbox and get it ready for use.
Run Masking Jobs with Flexible Execution
You now have more control over when to mask your data. You can either manually run masking jobs immediately or schedule masking jobs to run in the future - either single job runs or periodic job runs. This flexibility helps you align data preparation with your team's development cycles and maintenance windows.
Automate Data Masking with Run on Refresh
New for the app’s generally available release. Protect your sandbox data by using the Run on Refresh feature. Designate a policy to run a masking job automatically every time a sandbox is created or refreshed in your org. By automating the masking process, you prevent exposing sensitive production data in a newly created or a refreshed sandbox. You also eliminate the task of remembering to initiate manual masking.