Stop sensitive data at the pipe.
SafeStream Enterprise removes passwords, card numbers, personal data and API keys from your log and event streams while they are moving, before they land in your data lake, SIEM or warehouse.
{"LastName": "Smith", "card": "4111 1111 1111 1111", "msg": "retrying with key AKIAIOSFODNN7EXAMPLE", "status": 200}
{"LastName": "[REDACTED]", "card": "[REDACTED]", "msg": "retrying with key [REDACTED]", "status": 200}
Every company has the same leak
An engineer logs a request body to debug an incident. A payment service logs a customer record on error. Within hours that data is copied to Kafka, S3, Snowflake, Splunk and three backup tiers, and every copy is in scope for PCI-DSS, HIPAA and GDPR.
Cleaning it up afterwards means finding and rewriting every copy. SafeStream fixes it once, at the point where data comes in.
- Breach prevention at the source
- Sensitive values are removed before anything is stored, so a compromised log store holds nothing worth stealing.
- Compliance coverage on day one
- Built-in rules cover PCI-DSS data, the HIPAA Safe Harbor identifiers and GDPR personal data. No regex writing needed.
- Accurate on JSON and XML
- Records are redacted by field name and by content, so
"LastName": "Smith"is caught even though "Smith" matches no pattern. - Flat memory at any volume
- A 100 GB file or billions of events run in the same fixed memory. Traffic spikes can't crash it.
- Your data never leaves your network
- Fully self-hosted. No vendor cloud, no SaaS round-trip, no telemetry.
- Analytics keep working
- In pseudonymization mode the same customer always maps to the same token, so joins, counts and fraud models still work.
How it works
SafeStream runs as a Kafka consumer group on your Kubernetes cluster. Your applications don't change. Your data lake simply reads from the clean topic.
- Your applicationssend events as they do today
ingress-logsraw events- SafeStream Enterpriseredacts every record
egress-logs-cleanclean events only- Data lake, SIEM, warehouseS3, Snowflake, Splunk, Elastic
Structural rules
A field whose name signals sensitive data, such as password, card_number or patient_mrn, has its whole value removed, whatever the spelling style.
Content detection
Every other value is scanned with validated patterns, checksums and entropy analysis, which catches secrets hidden in free text.
Fail closed: a record that can't be processed goes to an access-restricted dead-letter topic, never to the clean one. Choose at-least-once or exactly-once delivery.
Compared with legacy DLP
| Legacy DLP suites | Cloud DLP APIs | SafeStream Enterprise | |
|---|---|---|---|
| When data is protected | After it is stored | Per API call, if every producer calls it | Before anything is stored |
| Where your data goes | Vendor appliance or agent | The vendor's cloud | Never leaves your network |
| JSON and XML logs | Treated as flat text | Partial schema work per API | Redacts by field and by content |
| Secrets and credentials | Rarely covered | Limited | Cloud keys, tokens, JWTs, private keys |
| Kafka | Custom glue, if at all | Custom glue per pipeline | Native consumer group |
| Cost | Per endpoint or seat | Per-GB fees that grow with volume | Your compute, no per-GB fees |
| Time to deploy | Months of tuning | Weeks of producer changes | One kubectl apply |
Compliance coverage
Built-in rules map to the data classes these frameworks regulate. SafeStream is a technical control that helps you meet them; certification remains a property of your environment and your audit.
| Framework | Covered out of the box | Typical control |
|---|---|---|
| PCI-DSS v4.0 | Card numbers (Luhn-validated), CVV/CVC fields | Req. 3: protect stored account data |
| HIPAA | Names, contact details, SSNs, medical record and insurance IDs, dates of birth, addresses, IPs | Safe Harbor de-identification, §164.514(b) |
| GDPR | Names, contact data, online identifiers, national IDs | Art. 25 data protection by design; Art. 32 pseudonymization |
| SOC 2 | Passwords, API keys, tokens, private keys, session cookies | CC6.1 logical access; CC6.7 data in transmission |
The connector also publishes content-free audit events: counts of what was removed, by type, that you can file as audit evidence without creating a new sensitive record.
Deploy with two commands
kubectl create secret generic safestream-secrets --from-literal=hmac-key="$(openssl rand -hex 32)" kubectl apply -f deploy/kubernetes/kafka-redactor.yaml
Then point your data-lake sinks at egress-logs-clean. The container is distroless, runs as non-root, and a default-deny network policy limits it to your brokers.
Open source and Enterprise
| SafeStream-Redactor (open source) | SafeStream Enterprise | |
|---|---|---|
| Streaming text redaction, constant memory | Yes | Yes |
| Personal data and credential detectors | Yes | Yes |
| CLI, REST, CI/CD gate, pre-commit | Yes | Yes |
| Field-aware JSON and XML redaction | No | Yes |
| Kafka consumer-group connector | No | Yes |
| Kubernetes deployment and network lockdown | No | Yes |
| Commercial support and SLAs | No | Yes |
Talk to us
Tell us about your pipeline: which brokers, roughly how many events a day, and which regulations apply. We'll set up a demo on data shaped like yours.
General questions: hello@safestreamdata.com