Protect fields, not just storage
Encrypt, tokenize, or mask PII, PHI, payment data, identifiers, credentials, and other regulated values before they spread across lake zones.
Data Lake Security for Sensitive Data
Protect sensitive fields across cloud data lakes, lakehouses, analytics, and AI without exposing every value in cleartext. Ubiq encrypts, tokenizes, or masks selected data, then governs the returned representation by identity and policy.
The same lakehouse record can serve different workflows safely
Ubiq evaluates the requesting identity, context, and policy at runtime, then returns the configured data representation for that request.
Access request
Production service
Data analyst
Analytics pipeline
AI agent
Protected lakehouse record
- Customer ID
- CUS-4829-7712
- Name
- Maria Chen
- mariac@acme.com
- Account
- 4829-7712-6084
Real-time evaluation
Ubiq
Identity
Context
Policy
Runtime data outcome
Production service
CleartextApproved operational request receives the required record
Customer:CUS-4829-7712Name:Maria ChenEmail:mariac@acme.comAccount:4829-7712-6084
Data analyst
MaskedCan investigate trends without reading full identifiers
Customer:CUS-••••-7712Name:M•••• C•••Email:m••••@acme.comAccount:••••-••••-6084
Analytics pipeline
TokenizedCorrelates records without original customer identifiers
Customer:CUS-7K2M-4830Name:PAT-6Q9M-1442Email:EML-4T8V-2031Account:ACC-9F4B-D108
AI agent
Masked and tokenizedReceives stable protected identifiers, while direct personal fields are masked or withheld
Customer:CUS-7K2M-4830Name:M•••• C•••Email:m••••@acme.comAccount:ACC-9F4B-D108
Protected once. Resolved differently at runtime for each identity.
Trusted in production by security & data teams
Fortune100
Fortune50
Why data lake security matters now
Data lakes already use IAM, object and table permissions, encryption at rest, catalogs, classification, and monitoring. Those controls matter, but they do not always govern which version of each sensitive value is returned after a requester reaches an approved file, table, dataset, or query path.
Storage encryption ends when the data is queried
Cloud and object-storage encryption protects files and media at rest. Query engines, notebooks, applications, and pipelines can still receive sensitive values in cleartext after access is granted.
Broad roles expose mixed-sensitivity datasets
A data lake table or file can combine low-risk operational fields with PII, PHI, financial data, credentials, or regulated identifiers. Dataset access can reveal more than the workflow needs.
Sensitive data multiplies across zones and copies
Raw, curated, analytics, feature, export, and lower-environment copies make it difficult to keep the original system's access controls attached to every sensitive field.
Static masking cannot serve every workflow
A fixed masked dataset may be too restrictive for approved operations and still too revealing for broad analytics, development, AI, or vendor access.
Ubiq closes that runtime gap by protecting the value and evaluating identity, context, and policy when sensitive data is requested.
What is data lake security?
Data lake security protects the sensitive information stored and processed across object storage, lakehouse tables, query engines, notebooks, pipelines, analytics, and AI workflows. Access controls, encryption at rest, and governance catalogs are important, but sensitive values can still be exposed after an approved identity reaches a file, table, dataset, or query result. Value-level protection keeps selected fields protected across copies and downstream uses while preserving the data workflows teams rely on.
Where Ubiq fits
Ubiq protects selected values across lakehouse copies and pipelines, then returns only the representation each identity and workflow is authorized to receive.
Keep analytics usable
Preserve the protected representations approved analytics, matching, segmentation, and data engineering workflows need.
Maintain consistent identifiers
Use deterministic protected values where joins, correlation, and record relationships must remain stable across copies and pipelines.
Govern the runtime representation
Evaluate the requesting identity, context, and policy before returning cleartext, masked, tokenized, or encrypted data.
Protect each data lake field with the right method
The appropriate protection method depends on the field and required use. These examples show how encryption, tokenization, and masking can reduce cleartext exposure while data engineering and analytics workflows continue to operate.
| Type | Original value | Method | Protected value | Result |
|---|---|---|---|---|
| Customer ID | CUS-4829-7712 | Tokenize | CUS-7K2M-4830 | TokenizedConsistent token supports approved joins without the original identifier |
| Email address | mariac@acme.com | Mask | m••••@acme.com | MaskedEnough detail remains for approved verification workflows |
| Account number | 4829-7712-6084 | Encrypt | 8F2A-C71B-4E09 | EncryptedStored and shared as protected data until an approved reveal |
| Loyalty account ID | LOY-4829-7712 | Tokenize | LOY-7K2M-4830 | TokenizedConsistent token supports segmentation and correlation without exposing the original account identifier |
Customer ID
CUS-4829-7712TokenizeCUS-7K2M-4830
TokenizedConsistent token supports approved joins without the original identifier
Email address
mariac@acme.comMaskm••••@acme.com
MaskedEnough detail remains for approved verification workflows
Account number
4829-7712-6084Encrypt8F2A-C71B-4E09
EncryptedStored and shared as protected data until an approved reveal
Loyalty account ID
LOY-4829-7712TokenizeLOY-7K2M-4830
TokenizedConsistent token supports segmentation and correlation without exposing the original account identifier
Protect sensitive fields before they spread through raw, curated, analytics, feature, export, and lower-environment copies.
Where teams use data lake security
Sensitive data moves through more than object storage. These are the workflows where value-level protection reduces unnecessary cleartext exposure across the lakehouse.
Cloud data lakes and lakehouses
Protect sensitive fields across raw, curated, and serving layers while approved applications and data teams continue to use the lakehouse.
Analytics and business intelligence
Give analysts and BI tools masked or tokenized values for reporting, segmentation, correlation, and approved joins without broad cleartext access.
Data engineering and pipelines
Protect values at or before ingestion, where the integration path allows, so sensitive fields remain protected through batch, streaming, ETL, ELT, and downstream copies.
AI and machine learning
Provide protected identifiers and governed source records to model, agent, and retrieval workflows when cleartext is not required.
Dev, test, and sandbox environments
Provision realistic protected datasets to engineering, QA, and vendor workflows without copying unrestricted production data into lower-trust environments.
Data sharing and clean-room data preparation
Prepare consistent protected identifiers and selected attributes for controlled partner sharing or clean-room workflows while original values remain governed.
Protect sensitive data across the lakehouse stack
Ubiq integrates where sensitive fields enter and leave the data lake, while protection and reveal operations execute through integrations inside your environment.
Ingestion and transformation pipelines
Apply protection in source applications, ingestion pipelines, or transformation workflows before sensitive fields land in raw, curated, or serving zones.
SQL and query-engine integration
Protect and reveal selected values through SQL UDFs and database or warehouse integration patterns used alongside the data lake.
Applications and data services
Enforce value-level outcomes where applications, APIs, and services read from lakehouse tables or derived datasets.
Existing IAM and identity context
Use the identities and access policies your organization already manages to govern runtime data outcomes.
Protection operations inside your environment
Ubiq coordinates policy through its SaaS control plane while protection and reveal operations run through integrations inside your environment.
Customer-managed keys
Use your HSM or KMS where required so cryptographic key ownership stays with your security team.
Frequently asked questions
What is data lake security?
Data lake security is the set of controls used to protect data stored and processed across object storage, lakehouse tables, query engines, notebooks, pipelines, analytics, and AI workflows. It includes identity and access management, encryption, governance, monitoring, and value-level protection for sensitive fields.
Why is encryption at rest not enough for a data lake?
Encryption at rest protects storage media and files, but approved query engines, applications, notebooks, pipelines, and users can still receive sensitive values in cleartext after access is granted. Value-level protection keeps selected fields protected and governs the representation returned at runtime.
How does Ubiq protect sensitive data in a data lake?
Ubiq protects selected fields and records with encryption, vaultless tokenization, masking, and format-preserving techniques where appropriate. Ubiq evaluates the requesting identity, context, and policy at runtime, then returns the configured cleartext, masked, tokenized, or encrypted representation.
Can Ubiq preserve joins and analytics on protected data?
Yes. Deterministic tokenization or encryption can produce consistent protected values for approved correlation, matching, and joins. Teams should select the protection method based on the field and workflow, and should not assume every encrypted or tokenized value preserves the semantics required for every analytical task.
Can Ubiq protect data used by AI and machine learning workflows?
Yes. Ubiq can keep sensitive source fields protected while AI, agent, and model workflows receive masked or tokenized representations when cleartext is not required. Vector-search use cases require a coordinated approach to source-data and vector-space protection, which is covered separately on Ubiq's RAG security page.
Does Ubiq replace data lake IAM or governance tools?
No. Ubiq complements IAM, catalog, governance, and data-platform permissions. Those controls determine whether a requester can reach a file, table, dataset, or query path. Ubiq governs the sensitive data representation returned after that access occurs.
Where does Ubiq run for data lake protection?
Ubiq provides a SaaS control plane while protection and reveal operations execute through integrations inside the customer's environment. Sensitive data does not need to be sent to Ubiq for protection or reveal, and customers can use their own HSM or KMS where required.
Explore related data protection capabilities
Use the protection method that fits each field, then govern runtime outcomes through the same identity-aware policy model.