It lands on your AWS bill
Pay through AWS Marketplace, draw down committed spend, skip a new-vendor security review and a separate PO.
PrivaCI Commercial
The masking engine you already trust — now with proof and support.
The PrivaCI engine is free and open source. Commercial PrivaCI is open source data masking commercial support: the compliance, automation, and support layer that turns a great tool into something you can put your name on in an audit. Same engine, same VPC, zero data egress.
Two flat tiers on AWS Marketplace — capability-based, no usage metering. Start on the OSS engine and upgrade in place.
Why teams upgrade
Open source masks the data. Commercial proves it.
Audit evidence, not screenshots
Hand auditors a cryptographically signed, reproducible report instead of assembling proof by hand each cycle.
Risk goes down, not up
Drift detection catches new PII columns before they reach staging — the failure mode that hand-rolled masking never sees coming.
What you get
Everything in OSS, plus the parts auditors and operators need
Multi-tenant staging
Copy one SaaS tenant to staging with a SQL predicate (tenant_id, slug, or date window). FK closure pulls related rows only — not the full production database.
Signed compliance reports
Tamper-evident, byte-for-byte reproducible run reports with Ed25519 detached signatures an auditor can verify independently. JSON and Markdown summary export.
Schema-drift detection
privaci detect-drift diffs each run's catalog snapshot against the last, classifies added/removed/retyped columns, and flags uncovered PII before it leaks.
JSONB path masking
Mask nested audit and event payloads in json/jsonb columns in place — structure preserved, invalid JSON never written.
Conditional masking (CEL when:)
Optional CEL when: guards on column actions — mask only when a row predicate is true (for example status == 'closed'). Standard and Compliance.
CI preview & policy diff
privaci preview emits redacted sample rows, policy-diff JSON, and SARIF for CI gates. Findings flow into signed reports via attention_required.
Capability-based entitlement
Your subscribed tier unlocks a fixed capability set, verified at container start — no source-database or data-volume counting. Operator setup is documented on docs.boundarylogic.io.
Run notifications
Slack and generic webhook notifiers fire on run completion so refreshes are visible to the whole team without babysitting a pipeline.
Trust & control
You keep the data, the keys, and the network
- Masks inside your VPC. The engine never phones home and runs fully offline.
- Compliance reports are signed with your own Ed25519 keys; signatures verify without trusting us.
- PII is never logged, never written to disk mid-run, and every SQL statement is parameterized.
Pricing
Two tiers, flat monthly pricing
Subscribe on AWS Marketplace — your tier unlocks a fixed capability set, verified at container start. Pricing flows onto your existing AWS invoice. Deployment options and licensing are documented for operators.
Standard
$149 / month
- Keyed pseudonymisation (hmac_hash, pseudonym)
- Conditional masking (CEL when:)
- JSONB path masking
- CI preview: sample rows + policy diff
The masking engine, fully unlocked.
Compliance
$749 / month
- Everything in Standard
- FK-aware subsetting
- Drift detection + strict-gate CI (SARIF)
- Signed, verifiable compliance reports
- Named support + SLA
Pipeline + evidence for regulated teams.
Ready when you are
Subscribe through AWS Marketplace and your team can be masking with signed reports the same day.
See it run
From config to signed audit report
A real terminal session on Demo Corp fixtures: dry-run and preview before you write a row, stream the mask job with FK-safe ordering, verify integrity without exposing values, then export a tamper-evident JSON report for auditors.
Buyer questions
Procurement & security, answered
How is it priced?
Two flat monthly tiers on AWS Marketplace: Standard ($149/mo) for keyed actions, CEL when: guards, JSONB path masking, and CI preview; Compliance ($749/mo) adds FK-aware subsetting, drift detection with strict-gate SARIF, and signed compliance reports. No per-database or per-GB counting — capability is verified when the container starts. Everything lands on your existing AWS invoice.
Why buy through AWS Marketplace?
It draws down your AWS committed spend (EDP), needs no new vendor onboarding or separate PO, and consolidates billing. Procurement is a few clicks instead of a quarter.
Do we still control our data and keys?
Yes. The commercial layer runs in your account and masks entirely in your VPC. Report signing keys are yours; we never see your data or PII.
What makes the compliance reports trustworthy?
Each report is canonicalized and signed with an Ed25519 detached signature, so it is tamper-evident and reproducible byte-for-byte. An auditor can verify it without trusting us.
Can we start on open source and upgrade later?
Yes. The OSS engine under ELv2 is the free evaluation path — same streaming, FK integrity, auto-detect, and audit log. When you need Standard or Compliance features, subscribe on AWS Marketplace and run the commercial container in your VPC. No migration — the plugin contract activates alongside the engine you already use.
Can I copy one tenant to staging?
Yes — on the Compliance tier, FK-aware subsetting starts from a root predicate such as tenant_id = 451 or tenant_slug = 'acme-corp'. PrivaCI walks foreign keys so related invoices, users, and events stay attached without copying every customer. See the commercial subsetting docs for YAML examples.
How do I choose or upgrade a tier?
Pick Standard when you need keyed pseudonymisation, row-conditional CEL when: guards, JSONB path masking, and CI preview on top of the OSS engine. Pick Compliance when auditors need signed reports, drift gates, or tenant-scoped subsetting. Switch tiers self-service in the AWS Marketplace console — no usage ceilings or overage billing.