DSGuard vs Ubiq Dynamic Data Masking

DSGuard is a self-hosted gateway that controls and audits database access between applications and databases. It applies identity-aware access rules, policies and dynamic masking, and lists PostgreSQL, Oracle Database, Microsoft SQL Server, MySQL, MariaDB through the MySQL-compatible wire protocol, MongoDB and ClickHouse. Controls include TOTP MFA, IP restrictions, role- and object-level permissions, SQL injection protection, dangerous-function blocking and rate limits. Data safeguards include full, partial and hash masking, column-level controls, response leak detection, result limits and query-result truncation. Query logs record identities, decisions and block reasons; Database Activity Monitoring adds native database audit, including activity that bypasses the gateway. Integrations include Prometheus metrics, Grafana dashboards and centralized logs for a SIEM. The site describes deployment on premises, in private or public cloud, or in hybrid environments, and lists AWS, Azure and GCP compatibility. The free Community edition is self-managed and has no support entitlement; Professional and Enterprise plans have annual terms, with prices not listed.

Ubiq Dynamic Data Masking protects sensitive data by determining at runtime what a requesting identity receives. Depending on the identity, application, service account, API, or workflow, the same value can appear as cleartext, masked, tokenized, format-preserving protected, or encrypted data. Sensitive values can remain protected at rest while policy determines their runtime form. Ubiq supports both permanent masked copies for development, test, vendor, and analytics use and runtime decisions for production access. Connections include SDKs, APIs, SQL UDFs, and database and data warehouse integrations; its catalog lists 49+ integrations, including PostgreSQL, MongoDB, Snowflake, Databricks, and Tableau. Ubiq says it deploys inside the customer’s environment, does not operate as a masking proxy between applications and databases, and can protect data without schema changes where applicable. Customers can use their own HSM or KMS to retain key control. Enterprise Edition pricing is usage-based through a private offer, and additional AWS infrastructure costs may apply. A 30-day trial is listed; there is no free plan.