PII detection & masking

Server-side detection and anonymization.

BARRY can detect and optionally anonymize personally identifiable information (PII) in the data passing through a transport, powered by Presidio — the open-source Data Privacy Stack project (not a Microsoft service), run as sidecar containers alongside the server.

Detection happens server-side and covers everything that flows through the runtime. Data that never reaches the server — an on-prem client writing to on-prem storage on the same machine — stays entirely within your network and is not inspected.

Two levels, both opt-in

A global master switch (Settings → Configuration) only unlocks the feature. Each transport must then explicitly opt in, and there are two independent levels:

• Detection — Presidio scans the data and records which PII entity types were found (e.g. person name, email, credit card). The transport is flagged Restricted (a label only — nothing in the data changes), and the detected entities surface on the run and in the Schema Registry.
• Anonymization — Presidio masks the matched values before they reach the sink, so the landed data no longer contains the raw PII.

The Presidio page

When the feature is enabled, the Presidio page (Management group, Admin) shows PII statistics across runs and a per-transport grid of what has been detected — a read-only observability view. The per-transport opt-in itself lives in the transport editor.

Operational notes

• PII scanning is CPU-heavy, so run a representative throughput check before enabling it broadly on high-volume transports.
• Model size and the number of analyzer / anonymizer instances are tunable in the Presidio settings, trading accuracy against cost.