Skip to content
SPECIFICTION
Get listed

SDSA

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 6.9 #18 of 26 in Data Masking Software

What it is

SDSA is a free, AGPL-3.0 self-hostable application for sanitizing tabular data before it leaves a trusted environment. It accepts CSV, delimited TXT, single-table SQL INSERT dumps, JSON records, and XML records through a browser interface or REST API. SDSA infers schemas and flags likely sensitive fields such as emails, phone numbers, card numbers, government IDs, dates of birth, names, and addresses. Transformations include masking, HMAC hashing, tokenization, redaction, dropping, numeric binning, date or string truncation, and bounded Laplace noise. Users can enforce k-anonymity for selected quasi-identifiers and measure or enforce l-diversity for sensitive cleartext attributes. The app exports sanitized CSV plus JSON and Markdown privacy reports with utility summaries. A headless command-line pipeline supports CI/CD and data pipelines. Sessions use in-memory storage for a default 30 minutes. Docker and Python installation are documented.

Spec sheet

What it does
SDSA is a self-hostable web app for sanitizing tabular data before it leaves a trusted environment, with privacy reports.Read 9 Oct 2026 · github.com
Purpose
SDSA is a self-hostable web app for sanitizing tabular data before it leaves a trusted environment.Read 8 Oct 2026 · github.com
Intended users
The maker describes SDSA for enterprise data-sharing workflows such as testing, QA, analytics, and external processing, with explicit policies and reviewable reports.Read 9 Oct 2026 · github.com
Deployment
The maker documents installation as a Python package or Docker deployment, including a production Docker Compose profile with nginx TLS termination.Read 9 Oct 2026 · github.com
License
The repository states SDSA is licensed under AGPL-3.0.Read 9 Oct 2026 · github.com
Data handling
Uploaded data, parsed dataframes, HMAC keys, and generated outputs stay in process memory and expire after the configured session TTL, which defaults to 30 minutes.Read 9 Oct 2026 · github.com
Deployment constraint
Deployments should run one SDSA application process unless the in-memory session store is replaced with shared storage, because multiple workers or replicas break the upload-to-download flow.Read 8 Oct 2026 · github.com
Deployment limit
The maker says to run one SDSA application process per deployment while sessions use in-memory storage, because multiple workers or replicas can break the upload-to-download flow.Read 9 Oct 2026 · github.com
Deployment security
The production Compose profile uses nginx for TLS termination, upload limits, security headers, and basic rate limits.Read 8 Oct 2026 · github.com
Input formats
It accepts CSV, delimited TXT, single-table SQL INSERT dumps, JSON records, and XML records through its browser UI or REST API.Read 9 Oct 2026 · github.com
Interfaces
Users can process data through a browser UI, REST API, or headless command-line pipeline for CI/CD and data pipelines.Read 8 Oct 2026 · github.com
PII detection
It infers schema and detects likely sensitive fields such as email, phone, card number, government ID, date of birth, name, and address.Read 8 Oct 2026 · github.com
Privacy controls
SDSA enforces k-anonymity over operator-selected quasi-identifiers and can measure or enforce l-diversity for sensitive cleartext attributes.Read 9 Oct 2026 · github.com
Privacy limitation
SDSA does not claim dataset-level (epsilon, delta) differential privacy and says auxiliary-data linkage attacks may still succeed.Read 9 Oct 2026 · github.com
Reports
Each processed release includes sanitized data and JSON and Markdown privacy reports with before-and-after utility summaries.Read 9 Oct 2026 · github.com
Security limits
SDSA says it does not provide dataset-level differential privacy or guarantee that auxiliary-data linkage attacks are impossible.Read 8 Oct 2026 · github.com
Supported data
It accepts CSV, delimited TXT, single-table SQL INSERT dumps, JSON records, and XML records.Read 8 Oct 2026 · github.com
Transformations
Available field actions include masking, HMAC hashing, tokenization, redaction, dropping, numeric binning, date or string truncation, and bounded Laplace noise.Read 9 Oct 2026 · github.com
Workflow integrations
SDSA provides a REST API and a headless command-line pipeline for CI/CD and data pipelines.Read 9 Oct 2026 · github.com

Strong points and limits

Strong points

  • Accepts five tabular input formats
  • Browser, REST API, and CLI interfaces
  • Multiple masking and transformation methods
  • K-anonymity and l-diversity controls
  • JSON and Markdown privacy reports

Limits

  • In-memory sessions last 30 minutes by default
  • Multiple workers can break upload-to-download flow
  • No dataset-level differential privacy claim
  • Auxiliary-data linkage attacks may still succeed

Who it suits

It suits enterprise data-sharing workflows such as testing, QA, analytics, and external processing. Teams needing on-premises deployment, APIs, or reviewable privacy reports are the stated audience.

Verdict

SDSA offers broad input support, configurable sanitization, and report generation for self-hosted data workflows. Deployment design and its stated privacy limits require careful operational review.

Where Specifiction places it

Alternatives to SDSAAll alternatives →