Built on SafeStream-Redactor, our open-source engine

Stop sensitive data at the pipe.

SafeStream Enterprise removes passwords, card numbers, personal data and API keys from your log and event streams in flight, before they land in your data lake, SIEM or warehouse.

Request Demo See the OSS docs

Self-hosted, no telemetry
Kafka-native on Kubernetes
Open-source core

Live demo: pick an example or edit the raw records.

ingress-logsraw, edit me

egress-logs-cleanwhat your lake keeps

0 values redacted

Runs in your browser with a subset of the rules. Nothing you type leaves this page.

One debug log line becomes a breach waiting to happen

An engineer logs a request body during an incident. Within hours that record is copied into every system your logs flow through, and each copy is in scope for PCI-DSS, HIPAA and GDPR. Cleaning up means rewriting every copy. SafeStream fixes it once, at ingestion.

payment-svclogs a customer record on errorthe leak
Kafka topicstreams it to every consumerin scope
S3 raw bucketarchives it for yearsin scope
Snowflake tablemakes it queryable by analystsin scope
Splunk indexmakes it searchable by everyone with accessin scope

Built for the way data really moves

Protection that sits inline, runs inside your own network, and keeps pace with your pipeline.

Breach prevention at the source

Sensitive values are removed before anything is stored, so a compromised log store holds nothing worth stealing.

Compliance out of the box

Built-in rules cover PCI-DSS card data, the HIPAA Safe Harbor identifiers and GDPR personal data. No regex writing on day one.

Field-aware on JSON and XML

Records are redacted by field name and by content, so "LastName": "Smith" is caught even though "Smith" matches no pattern.

Constant memory at any volume

A 100 GB file or a topic carrying billions of events runs in the same fixed memory. Traffic spikes can't cause out-of-memory crashes.

Your data never leaves your network

Fully self-hosted. No vendor cloud, no SaaS round-trip and no telemetry. The network policy limits the pod to your brokers.

Analytics keep working

In pseudonymization mode the same customer always maps to the same token, so joins, counts and fraud models still work.

How it works

SafeStream runs as a Kafka consumer group on your own Kubernetes cluster. Producers don't change; your data lake simply reads from the clean topic.

Your applicationssend events as they do today

ingress-logsraw events

SafeStream Enterpriseconsumer group that redacts every record, keys and headers too

egress-logs-cleanclean events only

Data lake, SIEMS3, Snowflake, Splunk, Elastic

Records that can't be processed go to ingress-logs-dlq, an access-restricted dead-letter topic, never to the clean one.

Check one: structural rules

A field whose name signals sensitive data, such as password, card_number or patient_mrn, has its whole value removed, nested objects included. lastName, last_name and LAST-NAME count as the same field.

{"LastName": "[REDACTED]", "card_number": "[REDACTED]"}
<Data Name="TargetUserName">[REDACTED]</Data>

Check two: content detection

Every other value is scanned by the open-source engine's detectors: validated patterns, checksums, entropy analysis and contextual scoring. That catches secrets hidden in free text.

{"msg": "retrying with key [REDACTED]"}
{"note": "contact [REDACTED] re: refund"}

At-least-once delivery default

Offsets commit only after the clean topic acknowledges the data. A crash replays records and never drops them.

Exactly-once delivery

Clean records, dead-letter records and offsets commit as one Kafka transaction, so a crash can neither drop nor duplicate a record.

Compared with legacy DLP

Legacy DLP was built to scan email gateways, endpoints and file shares on a schedule. Streaming data estates need prevention inline, at machine speed, inside your own infrastructure.

Capability	Legacy DLP suites	Cloud DLP APIs	SafeStream Enterprise
When data is protected	After it is stored, on scheduled scans	Per API call, if every producer calls it	Inline, before anything is stored
Where your data goes	Vendor appliance or agent	Sent to the vendor's cloud for inspection	Never leaves your network
Structured logs (JSON, XML)	Treated as flat text; field context lost	Partial, per-API schema work	Field-aware: redacts by key and by content
Memory at 100 GB+	Grows with input; large files skipped	Request-size limits	Constant, independent of volume
Cost model	Per-endpoint or per-seat licensing	Per-GB inspection fees that grow with volume	Self-hosted on your compute, no per-GB fees

Compliance coverage out of the box

Built-in field rules and detectors map to the data classes these frameworks regulate. SafeStream is a technical control that helps you meet them; certification remains a property of your environment and your audit.

PCI-DSS v4.0

Primary account numbers (Luhn-validated), CVV and CVC fields, card-number fields.

Req. 3: protect stored account data; keep logs out of cardholder-data scope.

HIPAA

Names, phone and fax, email, SSNs, medical record and insurance IDs, dates of birth, addresses, IPs.

Safe Harbor de-identification, §164.514(b).

GDPR

Names, contact data, online identifiers and national IDs.

Art. 25 data protection by design; Art. 32 pseudonymization.

SOC 2

Passwords, API keys, tokens, private keys and session cookies.

CC6.1 logical access; CC6.7 data in transmission.

Audit evidence that holds no sensitive data

Each window, the Kafka connector publishes counts of what it removed, by entity type, with the delivery mode, redaction mode and a fingerprint of the rules in force. It never contains the redacted values, so you can file it as audit evidence without creating a new sensitive artifact.

{
  "schema": "safestream.audit/v1",
  "delivery": "exactly_once",
  "redaction_mode": "pseudonymize",
  "records": { "egress": 48210, "dlq": 3 },
  "redactions": { "email": 9120, "person": 4471, "secret": 37 },
  "field_rules": { "count": 68, "fingerprint": "sha256:3f1c…" }
}

Running in your cluster in minutes

One secret, one manifest. Point your data-lake sinks at egress-logs-clean; producers don't need any changes.

# 1. Create the key for consistent pseudonyms
kubectl create secret generic safestream-secrets \
  --from-literal=hmac-key="$(openssl rand -hex 32)"

# 2. Deploy the connector
kubectl apply -f deploy/kubernetes/kafka-redactor.yaml

# 3. Point your sinks at egress-logs-clean

Distroless imageNo shell, no package manager, non-root, read-only filesystem, all Linux capabilities dropped.
Default-deny networkThe pod can reach your Kafka brokers and DNS, nothing else.
Fails closedBad configuration stops the pod with a clear error instead of letting data through.

Start open source. Scale with Enterprise.

Try the engine for free on your own data, then add the connector, field rules and support when it goes into production.

SafeStream-Redactor

The open-source engine

Free

Streaming text redaction in constant memory
Personal-data and credential detectors
Replace, mask and pseudonymize modes
CLI, REST API, CI/CD gate and pre-commit hook

Get it on GitHub

SafeStream Enterprise

For production

Everything in open source, plus

Talk to sales

Field-aware JSON and XML redaction
Kafka consumer-group connector, at-least-once or exactly-once
Kubernetes manifests with default-deny network lockdown
Custom field rules without rebuilds
Content-free compliance audit events and Prometheus metrics
Commercial support and SLAs

Request Demo

See it on data shaped like yours

Tell us which brokers you run, roughly how many events a day, and which regulations apply. We'll set up a demo around your pipeline.

Request Demo Read the security model