Endpoint Dynamic Data Masking That Keeps Cloud Data Unreadable After a Breach

CloudMask is a Canadian data protection vendor built around the premise that breaches are inevitable but data exposure is not. Founded in 2012 and headquartered in Ottawa by Dr. Wael Aggan and Tarek El-Gillani, the company targets business users, enterprise security teams, and SaaS developers who need sensitive information to remain unreadable inside cloud and on-premise applications. Its stated focus sectors include legal, financial, healthcare, education, and government, where cleartext data sitting in third-party infrastructure carries persistent regulatory and sovereignty risk.

The platform applies patented dynamic data masking at the endpoint rather than through a network gateway. Deployed as a browser extension or local agent, it intercepts sensitive application fields before they leave the device and substitutes randomly generated tokens that hold no mathematical relationship to the underlying values. Encryption relies on FIPS-compliant engines and identity-based asymmetric key pairs, with keys held exclusively by the user through an enterprise certificate authority, a managed PKI such as Entrust or WiseKey, or built-in identity management.

Because the masking layer is application-neutral, protection carries across Google Workspace, Microsoft 365, Salesforce, and custom applications without code changes or user retraining, and it is designed to hold even when the cloud provider, a privileged administrator, or the vendor's own management service is compromised. The company holds Common Criteria certification under ISO/IEC 15408, evaluated through Canada's Communications Security Establishment, an uncommon credential in this segment and the basis for its hold-your-own-keys positioning against gateway-based encryption products.