Skip to content
Data Maestro Download
Commands

Anonymization

The real, column-aware PII pipeline — heuristic + regex detection, per-column masking/pseudonymization strategies, compliance scoring.

scan-file

Detects PII columns in a file without changing it — a dry look before committing to anonymize-file. Ungated.

data-maestro-cli scan-file <input> [--sample-size 50] [--output <file>]
anonymize-file

Auto-detects and masks/pseudonymizes PII columns in a CSV/TSV/SSV/PSV, JSON/NDJSON, or flat-XML file. The whole file loads into memory — no streaming. Writes a <output>_report.json alongside the output.

data-maestro-cli anonymize-file <input> \
  [--output-mode overwrite|new] [--suffix _anonymized] \
  [--config corrections.json] [--sample-size 50] [--seed N] [--dry-run]
rows processed capped at 100 on the Free tier — see Free tier & licensing --output-mode new (default) writes a sibling file; overwrite replaces the input --config <file> per-column overrides, array of {column_name, category, strategy} --seed N reproducible output for the same input --dry-run detect and report, write nothing

scan-file / anonymize-file examples

See what would be detected, without changing anything

data-maestro-cli scan-file customers.csv | jq

Dry-run an anonymization — report only, nothing written

data-maestro-cli anonymize-file customers.csv --dry-run

Anonymize into a new file, leaving the original untouched (default)

data-maestro-cli anonymize-file customers.csv
# writes customers_anonymized.csv + customers_anonymized.csv_report.json

Reproducible output — same seed, same input, identical result every run

data-maestro-cli anonymize-file customers.csv --output-mode overwrite --seed 42

Override detection for specific columns instead of full auto-detect

# corrections.json: [{"column_name": "notes", "category": "notpii", "strategy": "keep"}]
data-maestro-cli anonymize-file customers.csv --config corrections.json
anonymize-db Pro / Team

Anonymizes PII directly in a live database table — one table, or several at once with foreign-key referential integrity preserved across them. No Free-tier mode; requires a valid license before anything else runs (no connection is attempted first).

data-maestro-cli anonymize-db --db-type <type> --host <host> --table <table> \
  [--config corrections.json] [--sample-size 50] [--seed N] [--dry-run]

# relational — multiple tables, referential integrity preserved
data-maestro-cli anonymize-db --db-type <type> --host <host> \
  --tables users,orders --relations relations.json \
  [--config table_corrections.json] [--dry-run]
--tables a,b,c switches to relational mode (mutually exclusive with --table) --relations <file> array of {parent_table, parent_column, child_table, child_column}

Relational safety is enforced, not best-effort: a relation naming a table outside --tables, a self-referential foreign key, or a cross-table foreign-key cycle are all rejected with a clear error rather than silently mishandled.

compliance-report Pro / Team

Turns an anonymize-file/anonymize-db report (single-table or relational — auto-detected) into a GDPR/LGPD/HIPAA-style audit document.

data-maestro-cli compliance-report <report.json> [--format markdown|html] [--output <file>]

Only markdown and html output exist — no PDF, no structured regulatory-checks JSON.

anonymize-db / compliance-report examples Pro / Team

Dry-run a single table first — see what would happen

data-maestro-cli anonymize-db --db-type postgres --host localhost \
  --port 5432 --database mydb --table users --dry-run

Anonymize it for real, writing a report alongside

data-maestro-cli anonymize-db --db-type postgres --host localhost \
  --port 5432 --database mydb --table users > report.json

Relational mode — anonymize related tables together, preserving foreign keys

# relations.json: [{"parent_table": "customers", "parent_column": "id", "child_table": "orders", "child_column": "customer_id"}]
data-maestro-cli anonymize-db --db-type postgres --host localhost --port 5432 \
  --database mydb --tables customers,orders --relations relations.json > report.json

Turn any anonymization report into an audit document

data-maestro-cli compliance-report report.json --format html --output audit.html

anonymize

anonymize is a standalone, deterministic pseudonym generator — the same input email always maps to the same output, picked from a small fixed pool of realistic-looking names and domains via a hash of the input. It's a quick single-value utility — the real, column-aware PII pipeline is scan-file/anonymize-file (files) and anonymize-db (live databases) above.

Basic usage

$ data-maestro-cli anonymize [email protected]
Anonymized email: [email protected]

Deterministic — same input, same output, every time

$ data-maestro-cli anonymize [email protected]
Anonymized email: [email protected]
$ data-maestro-cli anonymize [email protected]
Anonymized email: [email protected]

Anonymize every email in a CSV column, write a new file

tail -n +2 users.csv | cut -d, -f2 | while IFS= read -r email; do
  data-maestro-cli anonymize "$email"
done > anonymized_emails.txt

Parallelize across a large email list with xargs

cat emails.txt | xargs -P 8 -I{} data-maestro-cli anonymize {} > anonymized.txt