Anonymization and pseudonymization

Anonymization removes or alters identifiable fields so data can be used for analysis, testing, or sharing without exposing individuals. Pseudonymization replaces those fields with realistic substitutes, keeping the data usable while breaking the link to a real person. Applied to API traffic, both reduce the impact of a breach and limit how much sensitive data flows through your systems.

HARP lets you anonymize personally identifiable information (PII) in your API responses without changing application code, using techniques such as masking values or replacing them with fake ones.

You implement this with HARP's rules engine. Rules match requests and responses with patterns, then run Python to rewrite their content, so you can mask or replace sensitive fields in transit. This keeps personal data out of logs, downstream services, and test environments, which helps you address requirements in regulations such as the General Data Protection Regulation (GDPR) in the European Union or the California Consumer Privacy Act (CCPA) in the United States.

Example of anonymization techniques

{
  "name": "John Doe",
  "email": "john.doe@example.com",
  "phone": "+1-800-555-1234",
  "address": "1234 Elm Street, Springfield"
}

{
  "name": "*****",
  "email": "*****",
  "phone": "*****",
  "address": "*****"
}

{
  "name": "Jane Smith",
  "email": "jane.smith@example.com",
  "phone": "+1-800-555-6789",
  "address": "4321 Oak Avenue, Metropolis"
}

Laws and regulations

Privacy rules vary by territory. Examples include the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) in the United States, and Brazil's LGPD, along with similar data-protection laws in many other jurisdictions.

By letting you anonymize sensitive fields in API traffic as it passes through, HARP gives you a single place to enforce these data-minimization rules across the APIs your applications consume.