dbsafedump

v1.0.4

Published

12 days ago

Safe database dump with anonymization

0High
0Medium
0Low

sc-it

database anonymization dump masking gdpr privacy

DBSafeDump

Safe database dump with anonymization for GDPR compliance.

Overview

DBSafeDump is a CLI tool for safely dumping and anonymizing database data. It helps you:

Dump databases with automatic sensitive data masking
Migrate data between databases with anonymization
Scrub existing databases in-place
Discover sensitive columns automatically

Designed for GDPR compliance, CI/CD pipelines, and safe development workflows.

Features

Deterministic masking - Same input = same output (for consistent test data)
Multiple databases - MySQL, PostgreSQL, MSSQL, SQLite
European data - Names, addresses, phone numbers, companies
Smart Discovery - Automatic detection of sensitive columns
CI/CD ready - Non-interactive mode for automation
License management - Per-machine activation

Pricing

DBSafeDump uses a freemium model.

FREE - Free forever, 1,000 rows per table limit
STARTER - Import, migrate, multi-profile, Smart Discovery
PRO - In-place scrub, CI/CD mode, full Smart Discovery

See all plans and pricing

For enterprise needs, contact us

Installation

Prerequisites

Node.js 18+
npm or yarn

Install globally

npm install -g dbsafedump

Or use npx (without installation)

npx dbsafedump dump

Build from source

git clone <repository>
cd dbsafedump
npm install
npm run build

Quick Start

1. Initialize configuration

dbsafedump init

This creates config.yml and starts an interactive wizard to configure your database connections.

2. Test connection

dbsafedump test-connection

3. Run dump

dbsafedump dump -o dump.sql

License Activation

DBSafeDump uses a freemium model. The FREE tier works without any license.

Need more features? Buy a license at dbsafedump.com/pricing

Activate (STARTER/PRO only)

dbsafedump activate "YOUR-LICENSE-KEY"

Check status

dbsafedump license

Deactivate (move to another machine)

dbsafedump deactivate

Privacy

DBSafeDump collects minimal data for license verification only:

Device fingerprint: Hardware identifiers (MAC address, CPU, memory) hashed locally
License key: Stored locally, sent to license server for activation
No telemetry: No usage tracking, no analytics, no data collection beyond license checks
Offline mode: FREE tier works completely offline; paid licenses require connection once per hour for verification

All data is processed locally. Only the encrypted license key is transmitted to the activation server.

Commands

init

Initialize configuration and run interactive setup wizard.

dbsafedump init
dbsafedump init --force    # Overwrite existing config

config

Run the interactive configuration wizard.

dbsafedump config

dump

Export database with anonymization to SQL file.

dbsafedump dump
dbsafedump dump -o backup.sql
dbsafedump dump -c config.yml
dbsafedump dump --profile dev
dbsafedump dump --ci

import

Migrate data from source to target database with anonymization.

dbsafedump import
dbsafedump import --mode truncate    # Replace data
dbsafedump import --mode append      # Add data
dbsafedump import --ci

scrub

Anonymize data in-place in existing database. This is a destructive operation - it CANNOT be undone.

dbsafedump scrub
dbsafedump scrub --ci --force

Note: The --ci and --force flags skip the confirmation prompt. Always verify your target database in config.yml before running.

schema

Show database schema (tables, keys, row counts).

dbsafedump schema

discover

Analyze database and suggest masking rules.

dbsafedump discover
dbsafedump discover --output rules.json
dbsafedump discover --apply      # Apply to config

test-connection

Test database connections.

dbsafedump test-connection

profiles

List available configuration profiles.

dbsafedump profiles

activate

Activate license on this machine.

dbsafedump activate "LICENSE-KEY"

deactivate

Deactivate license (releases for another machine).

dbsafedump deactivate

license

Show current license status.

dbsafedump license

generate-salt

Generate new salt for deterministic masking.

dbsafedump generate-salt
dbsafedump generate-salt --yes    # No confirmation

Configuration

Configuration is stored in config.yml.

Basic structure

project: my-project
salt: generated-salt-here

connections:
  source:
    driver: mysql
    host: 127.0.0.1
    port: 3306
    database: source_db
    username: user
    password: "pass"

  target:
    driver: mysql
    host: 127.0.0.1
    port: 3306
    database: target_db
    username: user
    password: "pass"

Tables configuration

tables:
  exclude:          # Tables to skip
    - logs_*
    - cache_*
  include:          # Only these tables (empty = all)
    - users
    - orders
  truncate:         # Truncate before import
    - users
  keyColumns:       # Custom keys for tables without PK
    pivot_table: "col1,col2"

Masking rules

rules:
  "users.email": email
  "users.phone": phone
  "users.password": null        # Replace with NULL
  "users.name": fullName

Options

options:
  batchSize: 5000        # Rows per batch
  addDropTable: false    # Include DROP TABLE
  addCreateTable: true   # Include CREATE TABLE
  transaction: true      # Use transactions

Multi-profile (STARTER/PRO)

profiles:
  dev:
    connections:
      source:
        host: localhost
        database: myapp_dev
  staging:
    connections:
      source:
        host: staging.example.com
        database: myapp_staging
  production:
    connections:
      source:
        host: prod.example.com
        database: myapp_prod

Masking Types

Available maskers

| Type | Example Output | Use Case | |------|---------------|----------| | email | [email protected] | Email addresses | | phone | +49 123 456 789 | Phone numbers | | firstName | Liam, Emma, Hans | First names | | lastName | Mueller, Kowalski | Last names | | fullName | Liam Mueller | Full names | | address | 42 Bahnhofstrasse, Berlin | Addresses | | ip | 10.45.123.78 | IP addresses | | username | user_a1b2c3 | Usernames | | password | 7f8e9d0c1b2a3f4e | Passwords | | creditCard | 1234 5678 9012 3456 | Credit card numbers | | date | 2023-05-15 | Dates | | company | Alpha Solutions GmbH | Company names | | pesel | 83020501234 | Polish PESEL | | nip | 1234563210 | Polish NIP | | regon | 123456789 | Polish REGON | | iban | PL 1234 5678 9012 | IBAN numbers | | uuid | a1b2c3d4-0000-0000-0000-000000000000 | UUIDs | | random | 8f7e6d5c | Random string | | null | NULL | Replace with NULL | | preserve | Original value | Keep as-is |

Auto-detection

DBSafeDump automatically detects these column types:

Columns with email, mail → masked as email
Columns with phone, tel, mobile → masked as phone
Columns with name → masked as fullName
Columns with password, passwd → masked as null
Columns with address, street, city → masked as address
And more...

Use Cases

1. Development Database Setup

Create safe development copy of production data.

# Dump production with anonymization
dbsafedump dump -o dev_dump.sql

# Import to development database
dbsafedump import

2. GDPR Compliance

Anonymize data before sharing with third parties.

# Anonymize existing database
dbsafedump scrub --ci --force --profile production

3. Multi-Environment Migration

Move data between environments with consistent anonymization.

# config.yml
profiles:
  staging:
    connections:
      source:
        host: prod.example.com
        database: customers
      target:
        host: staging.example.com
        database: customers_staging

# Migrate staging → production
dbsafedump import --profile production --ci

4. Test Data Generation

Create deterministic test data.

# Generate dump with fixed salt
dbsafedump dump -o test_data.sql

# Same input = same output
# [email protected] → [email protected]

5. CI/CD Pipeline

Automated data anonymization.

# .github/workflows/scrub.yml
name: Anonymize Production Data

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  anonymize:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install DBSafeDump
        run: npm install -g dbsafedump
      - name: Run anonymization
        run: dbsafedump scrub --ci --force --profile production

CI/CD Integration

GitHub Actions

name: Database Operations

on: [push]

jobs:
  dump:
    runs-on: ubuntu-latest
    steps:
      - name: Setup
        run: npm install -g dbsafedump
      
      - name: Create Dump
        run: dbsafedump dump --ci -o dump.sql
        env:
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
      
      - name: Upload Dump
        uses: actions/upload-artifact@v3
        with:
          name: database-dump
          path: dump.sql

GitLab CI

anonymize:
  script:
    - npm install -g dbsafedump
    - dbsafedump scrub --ci --force --profile production
  only:
    - schedule
  schedule: '0 2 * * *'

Jenkins

pipeline {
    agent any
    stages {
        stage('Anonymize') {
            steps {
                sh 'npm install -g dbsafedump'
                sh 'dbsafedump scrub --ci --force --profile production'
            }
        }
    }
    triggers {
        cron('0 2 * * *')
    }
}

FAQ

Q: Is there a free version?

Yes! DBSafeDump has a freemium model. The FREE tier is free forever with 1,000 rows per table limit. See all plans

Q: How does deterministic masking work?

The same input value always produces the same output. This is useful for:

Consistent test data
Joining anonymized tables
Reproducible dumps

The salt in config.yml ensures deterministic output.

Q: Can I change the salt?

Yes, but changing the salt re-masks all data differently.

dbsafedump generate-salt

Q: How is license bound to machine?

License is bound to machine fingerprint (MAC address + machine ID). Each license key can be activated on one machine at a time.

Q: Can I move my license to another computer?

Yes! Just run dbsafedump deactivate on the old computer, then dbsafedump activate "KEY" on the new one. Your license can be transferred anytime.

Q: What happens if API is offline?

If the license server is unreachable, the app falls back to FREE tier (1000 rows limit).

Q: Can I use DBSafeDump without internet?

Yes, after initial activation, the license is cached for 1 hour. After that, re-verification is needed.

Q: Which databases are supported?

MySQL / MariaDB
PostgreSQL
MSSQL / SQL Server
SQLite

Q: How do I report issues?

Open an issue at [email protected]

Support

Documentation: https://dbsafedump.com/docs
Website: https://dbsafedump.com
Pricing: https://dbsafedump.com/pricing