Data masking changes the sensitive fields in your real records and keeps everything else; synthetic data replaces the records entirely with generated ones. If your data stays inside your company for testing, masking is often enough and costs less. If the data will leave your control, or masked rows would still point to real people, synthetic data is the safer choice.
What does each one do to your data?
Masking starts from real rows. Names become fake names, card numbers become valid-looking fakes, dates shift, free text gets scrubbed. Every row is still a real customer, order or event, with the sensitive values swapped. The structure, the odd edge cases and the volume are exactly what production has.
Synthetic generation starts from the patterns. A generator learns the distributions and relationships in the real tables, then produces new rows. No output row is a real record, and the dataset can be larger, smaller or rebalanced.
| Data masking | Synthetic data | |
|---|---|---|
| Rows | Real rows, sensitive fields replaced | New rows generated from learned patterns |
| Keeps real edge cases | Yes, all of them | Only as well as the generator learned them |
| Main privacy risk | The unmasked fields still identify people | The generator memorized real records |
| Can change volume or balance | No | Yes |
| Typical use | Internal test and staging databases | Sharing, publishing, model training, demos |
When is masking enough?
When three things hold: the data stays inside your organization, behind your own access controls; the people using it are your own engineers or testers; and the remaining fields cannot easily point to individuals. Masking keeps every real quirk, which is what a test suite needs to catch real bugs. It is also simpler to run and to explain to a security team.
The weak point is what masking leaves behind. Replace the name and email in a customer row and the combination of birth year, ZIP prefix, plan and purchase history may still identify one person. The more columns you keep, the more likely that is.
When do you need synthetic data instead?
- The data leaves your control. A partner, a vendor, an outside analyst or a public release.
- Masked rows still identify people. Too many quasi-identifiers survive masking for the data to be safe.
- You need more or different data. More rows than you have, or more of a rare case.
- You are training a model others will query. A model can leak what it was trained on, so the training set should not hold real people.
For any of these, the privacy method behind the generator matters. Our tabular synthetic data page covers what to ask.
What is synthetic test data?
It is synthetic data made for software testing: a staging database filled with generated rows that behave like production (valid keys, realistic values, business rules intact) without real customers in it. It sits between the two approaches, and many tools mix them. K2view describes a synthetic data tool that combines AI generation, business rules, cloning and masking. Tonic.ai sells Structural for databases and other structured data, Textual for free text and files, and Fabricate, bought in April 2025, for generating new data from a schema or a prompt.
The test for synthetic test data is practical: run your test suite on it and count failures caused by impossible values or broken keys rather than real bugs.
What does Tonic.ai cost, and what are the alternatives?
Tonic.ai does not publish prices on the page we read; expect a quote shaped by data volume, seats and where the software runs. The other tabular vendors on our list are the obvious alternatives, and only one of them shows anything about price.
| Vendor | What it says it makes | Published price |
|---|---|---|
| Tonic.ai | Structural, Textual and Fabricate | Not published |
| K2view | Synthetic data with rules, cloning and masking | No prices; offers a "Start Free" option |
| Syntho (with MOSTLY AI) | Synthetic tabular data platform | Not published |
| Aindo | Synthetic data platform aimed at regulated sectors | Not published |
| SAS Data Maker | SAS's synthetic data product, built on Hazy's software | Not published |
Vendors in this table may pay us an introduction fee if a team we put in touch signs with them; it does not change the list, its order or what we say about them.
They differ most in relational support (keeping keys consistent across many tables), where the software runs (inside your cloud account or theirs), whether masking and generation live in one tool, and what privacy method they offer.
How do you decide?
Write down where the data will go and who will use it. If the answer is “our own test environment, our own engineers”, start with masking and check what the unmasked columns reveal. If the data will leave your control, compare the synthetic data companies on their privacy evidence, and ask each for a trial on a sample of your own tables.
Masking hides who is in your data; synthetic data means nobody is in it at all.