Reproduce issues sooner
Skip the incident-time export queue. Investigate against a continuously maintained replica with familiar schemas and consistently transformed values.
REAL DATA STRUCTURE. LESS EXPOSURE.
Production shape.
Private by design.
Give development, testing and staging the shape of production, with less personal data. Transform sensitive values as you replicate — from the first copy to ongoing changes.
Production shape. Private by design.
THE REPLICATION PATH
ILLUSTRATIVE DATA
01
Your production database
Sensitive fields selected by your rules
Transform in flight
Your rules. Consistent results.
02
Your development replica
Familiar structure. Transformed values.
BUILT FOR YOUR DATA STACK
PostgreSQL + Patroni
MySQL / MariaDB / Percona
Redis / Valkey 8.1+
MongoDB 6.0+ change streams
Apache Kafka / Redpanda
SQL Server 2019 / 2022 · CDC
Oracle 19c–23ai · LogMiner
CouchDB 3.x · _changes
FROM INCIDENT TO INVESTIGATION
ILLUSTRATIVE WORKFLOW
PRODUCTION / ISSUE DETECTED
Checkout fails for a customer
TRACE
Your development replica is already receiving
transformed production changes.
DEVELOPMENT ENVIRONMENT
REPLICA
01
customer_id usr_1042
02
email [email protected]
03
checkout_status failed
↳ Reproduce. Inspect. Iterate.
Production issue
→
Development investigation
READY BEFORE THE INCIDENT
Debug now.
Skip the data refresh.
Keep a development replica continuously updated, with sensitive values transformed in flight. When a production issue appears, start investigating without waiting for a fresh export.
Less time preparing data. More time understanding what went wrong.
Find your database project →One initial sync. Continuous updates. Ready for your next investigation.
01 / THE ADVANTAGE
Realistic environments.
Less sensitive data.
Move beyond stale fixtures and repeated manual exports. Keep a separate replica that reflects your application’s data, with transformation rules you control.
Ready before the incident
After the initial sync, ongoing changes stream into your development environment — keeping your team ready to investigate with continuously updated data.
Own the data boundary
Run the tools in your infrastructure. Choose which fields or keys to hash, mask, or replace, and backfill when your rules change.
02 / PRIVACY BY DESIGN
Build privacy into
every environment.
A production copy can bring customer identities, contact details and sensitive records into development. Define what your team actually needs, then transform the rest before granting access.
Reduce what a leak exposes
Replace or remove sensitive values to limit exposure from accidental sharing, stolen credentials or deliberate data theft. Combine transformation with access controls, protected keys and retention limits.
Keep test emails away from customers
Replace real recipient addresses with deterministic fake emails using example.com. Route non-production mail to a sandbox and restrict outbound delivery too: data transformation does not disable email sending.
Make privacy part of release readiness
Review sensitive columns, Redis keys and nested JSON fields. Complete initial transformation and any backfill before sharing a replica, and review coverage again when schemas or rules change.
What the rules mean for test data
Privacy obligations follow the data into development, testing and staging. These laws and standards have different scopes; they do not impose a universal ban on all personal data outside production.
GDPR · Article 25
Build appropriate safeguards into processing from the outset. Limit personal data by default to what each purpose needs; pseudonymisation is one measure Article 25 explicitly identifies.
Read Article 25HIPAA
For covered entities and business associates, protected health information remains subject to HIPAA safeguards. De-identification requires Safe Harbor or Expert Determination; replacing names alone is insufficient.
HHS de-identification guidancePCI DSS · 6.5.5
Live primary account numbers must stay out of pre-production unless that environment is inside the cardholder data environment and meets all applicable PCI DSS requirements.
Read PCI DSS 4.0.1 · requirement 6.5.5CCPA / CPRA
Covered businesses must limit collection, use and retention to purposes permitted by the law, and keep them reasonably necessary and proportionate. A development copy deserves its own purpose and data review.
California privacy agency guidanceMasking, pseudonymisation and anonymisation: what changes?
Masking describes a transformation. It does not, by itself, establish that people can no longer be identified. Stable hashes, retained identifiers and combinations of other fields can still link records to individuals.
Pseudonymised data can remain personal data. Assess the complete dataset, access to additional information and the risk of re-identification before treating a replica as anonymous. DevReplicate provides configurable transformation tools; it does not certify a deployment as compliant.
Read the ICO’s explanation of pseudonymisation03 / THE PROJECTS
One philosophy.
Native to your database.
Eight purpose-built replicators, one shared approach to configurable anonymization. The transforms come from the same library, so a value anonymizes to the same bytes whichever engine produced it.
PG
POSTGRESQL
Patroni Anonymizer
patroni-anonymizer
Open source + Enterprise
An anonymized PostgreSQL replica, with primary discovery through Patroni and change capture through logical replication.
- Consistent baseline snapshot
- Column-level transformations
- Patroni primary discovery
MY
MYSQL / MARIADB / PERCONA
MySQL Anonymizer
mysql-anonymizer
Open source + Enterprise
Bring MySQL, MariaDB, and Percona Server data into development with configured transformations applied to snapshots and binlog changes.
- Snapshot and binlog replication
- Hash, mask, and deterministic fake values
- Backfill newly configured fields
RE
REDIS / VALKEY
Redis Anonymizer
redis-anonymizer
Open source + Enterprise
Transform matching values through the Redis replication protocol, then write them to a separate target instance. Redis and Valkey (8.1 and later, including Valkey 9's own RDB format) are one product and one license.
- Initial sync and PSYNC streaming
- Key-pattern and value selection rules
- Standalone, Sentinel, and Cluster
MG
MONGODB
MongoDB Anonymizer
mongodb-anonymizer
Open source + Enterprise
Copy every collection once, then tail the deployment’s change stream as an ordinary client, rewriting configured fields before they reach a separate target deployment.
- MongoDB 6.0+ replica set or sharded cluster
- Exact field paths, including array steps
- Resume token checkpointed on the target
KA
APACHE KAFKA / REDPANDA
Kafka Anonymizer
kafka-anonymizer
Open source + Enterprise
Consume each mirrored topic as an ordinary client and produce the anonymized record to the same-named topic on a separate cluster — same partition, key, headers and timestamp.
- Kafka 3.x in KRaft mode, and Redpanda
- Rules on the value, the key or a named header
- A topic no rule matches is not mirrored
MS
MICROSOFT SQL SERVER
SQL Server Anonymizer
mssql-anonymizer
Open source + Enterprise
Recreate every user table on the target and copy it with transforms in flight, then keep it current from Change Data Capture, applied in the source’s commit order.
- SQL Server 2019 and 2022, an edition with CDC
- Column-level transformations
- Checkpoint inside the same target transaction
OR
ORACLE DATABASE
Oracle Anonymizer
oracle-anonymizer
Open source + Enterprise
Copy each table as of one SCN with transforms in flight, then mine the source’s online and archived redo with LogMiner and apply every committed transaction.
- Oracle Database 19c, 21c, 23ai and 26ai
- Supplemental logging of all columns required
- One target transaction per source transaction
CO
COUCHDB
CouchDB Anonymizer
couchdb-anonymizer
Open source + Enterprise
Read the source through CouchDB’s own HTTP API — _all_docs for the first copy, a continuous _changes feed afterwards — and write anonymized documents to a separate server.
- CouchDB 3.x on both sides
- JSON field paths, including array steps
- Never the byte-for-byte built-in replicator
Protection follows your configuration. Unconfigured SQL columns and unconfigured document fields pass through unchanged, as do unmatched Redis keys by default — Redis also offers an explicit reject policy for them. Kafka is the exception: a topic no rule matches is not mirrored at all unless you ask for passthrough. Review coverage before sharing a replica.
04 / TRANSFORM REFERENCE
The right treatment
for each field.
Choose from keyed hashes, configurable masks, three kinds of fake values, integer pseudonyms, SQL nulling and nested JSON rules. Match the treatment to the data’s sensitivity and what your tests need to exercise.
hash
Stable identifiers
Use keyed HMAC-SHA256 to replace a value consistently. Apply the same key and settings wherever matching values must stay aligned.
Useful for: linked identifiers. Choose output length with collision risk and column limits in mind.pseudo_id
Joinable integer identifiers
Accepted by every product in the family: a deterministic, injective, format-preserving pseudonym within a declared digit width (1–18), keyed by the product’s hash key. Use the same key, width and optional domain label on related identifiers to preserve joins.
Keeps matching integer IDs joinable across systems. Use the same key, width and domain everywhere the ID appears. Configure pseudo_id.mask
Controlled partial values
Replace a value with a literal pattern and, optionally, retain a limited suffix for tests that need it.
Useful for: display formatting. Retained characters still disclose part of the original.fake · email
Replacement recipients
Generate consistent replacement addresses at example.com, so configured fields no longer contain customer inboxes.
fake · name / address
Readable test records
Replace names and addresses with deterministic values drawn from built-in word lists.
Useful for: forms and interfaces. Fake names and addresses can repeat; do not use them as unique identifiers.null · SQL
Remove unnecessary values
Replace a configured SQL column with NULL when its contents are unnecessary for development or testing.
json
Reach inside documents
Apply nested transformations to selected JSON paths, including object fields and array elements.
Useful for: embedded profiles and contact details. Unselected content still needs a privacy review.From a field inventory to a usable replica
- Identify Find sensitive values, including free text, nested fields and identifiers.
- Configure Choose transforms and consistent keys for related values.
- Validate Check coverage, constraints and output before giving your team access.
Rule syntax and supported selectors depend on the database engine. Keep transformation keys separate from developer access, and review exports, backups and logs as well as the live replica.
05 / ENTERPRISE
From replication
to repeatable operations.
The core handles anonymized replication. Enterprise adds the interfaces, visibility, and backup workflows your operations team can build around.
APACHE 2.0
A capable open-source core.
Initial sync, streaming replication, configurable transforms, and backfill are part of the core projects.
COMMERCIAL LICENSE
More control with Enterprise.
Authenticated reconfiguration APIs, Prometheus metrics, product-specific backup and restore bundles, and an authenticated API developers use to download the latest anonymized copy they are authorized for.
| Capability | Core | Enterprise |
|---|---|---|
| Initial sync & continuous replication | Included | Included |
| Configurable transforms & policy re-baseline | Included | Included |
| Self-hosted deployment | Included | Included |
| OAuth2 / RS256 reconfiguration API | — | Included |
| Prometheus metrics endpoint | — | Included |
| Replica backups & restore bundles | — | Engine-specific |
| Authenticated developer download API | — | Included |
Enterprise adds product-specific backup and restore workflows and licensed downloads across the product family. Licences and keys are managed at account.devreplicate.com.
Compare Core and Enterprise pricing →
A CLOSER LOOK
Backups that fit your engine.
Download the latest anonymized database: HTTPS, byte-range resume, SHA-256 verification and local restore.
Build with the shape
of production.
Start with the engine you run. Choose Enterprise when you need API-driven operations, monitoring, and backup and instant-restore workflows.
Find your project ↗