Salesforce Data Mask Is Retiring: What to Do Before December 31, 2026
Salesforce is retiring the Data Mask managed package in two steps. Support ended on July 9, 2026, so new issues won't be fixed, and the package becomes read-only on December 31, 2026. Salesforce's replacement is Data Mask & Seed, a core app available since the Summer '26 release. Existing configurations don't carry over automatically: you rebuild them as new masking policies. If you mask Full or Partial Copy sandboxes today, you need a replacement working before your first refresh after December 31.
The rest of this post covers exactly what's changing, what Data Mask & Seed is, how to migrate, and the alternatives if you'd rather not.
What exactly is changing, and when?
Two Salesforce pages give slightly different versions, so it's worth knowing both:
- The retirement article, Data Mask Managed Package End of Support (updated October 3, 2026), says Salesforce "ended support for the existing Data Mask managed package on July 9, 2026", that issues found after that "will not be fixed", and that "the package will be read-only starting December 31, 2026."
- The legacy Data Mask overview and Salesforce's product retirements list give December 31, 2026 as the end-of-support date.
The safe reading is that you're already unsupported, and December 31 is the hard stop.
What does "read-only" mean for your sandbox refreshes?
Salesforce doesn't define what read-only means for running mask jobs, so don't count on them working after December 31.
That matters because of how Data Mask works. You install the package in production, and its configuration appears in a sandbox when the sandbox is created or refreshed. Then someone runs the mask from the sandbox (Trailhead: Install and Configure Salesforce Data Mask). Between the refresh and the mask run, the sandbox holds real production data. If the mask can't run, that data stays unmasked.
So the real deadline is your first Full or Partial Copy refresh after December 31. If a Full sandbox refresh is on your calendar for January, the replacement needs to be tested before then.
What is Data Mask & Seed?
Data Mask & Seed is Salesforce's successor. It's been available to all customers since the Summer '26 release on July 18, 2026, and it runs as a core app with a simpler UI rather than as a managed package (Summer '26 release overview). According to Salesforce's data masking product page, it adds:
- Proactive PII detection, instead of you listing every sensitive field yourself.
- Seeding: using seed templates to bring production data and its relationships into Developer, Developer Pro, Partial Copy or Full sandboxes.
- Scheduling: mask or seed jobs can run daily, weekly or monthly.
- Masking options for anonymization, pseudonymization, pattern-matching and deletion.
Seeding has documented limits. Big objects, formula fields, Chatter objects and external objects aren't supported (Trailhead: seeding best practices).
Pricing. Salesforce's add-on pricing page lists Data Mask & Seed at 10% of net spend for Enterprise and Unlimited editions. The help documentation lists Professional, Enterprise, Unlimited and Developer editions with the Data Mask add-on license, and requires Lightning Experience. Salesforce hasn't said publicly whether an existing Data Mask license covers the new product. The retirement article points cost questions to your account team, so ask before you budget.
How do you migrate from Data Mask to Data Mask & Seed?
There's no automatic conversion. Salesforce's guidance is to "create new masking policies to replace your existing masking configurations", and new features only work in new policies (retirement article). A practical sequence:
- Inventory what you mask today. Export or screenshot every legacy configuration: objects, fields and masking type. Note which sandboxes depend on it and when each is next refreshed.
- Confirm licensing. Find out from your account team whether Data Mask & Seed is covered, and assign the Data Mask & Seed permission set license to the admins who'll build policies.
- Rebuild the configurations as new policies. Custom libraries don't need to be recreated. Run Data Mask & Seed's PII detection too: it may find fields your old configuration missed.
- Test on a refreshed sandbox. Both products can run in the same org at once, so you can compare results without losing your current masking.
- Switch over and uninstall. Once your policies are moved and tested, uninstall the managed package, ideally well before December 31.
Budget real time for steps 3 and 4. Rebuilding policies is manual, and masking that has never been tested is masking you can't rely on.
What are the alternatives to Data Mask & Seed?
Moving to Data Mask & Seed is the path of least resistance if you're happy with in-sandbox masking and the pricing works for you. If not, there are four other approaches:
1. Apex post-copy scripts. Salesforce's SandboxPostCopy interface runs an Apex class automatically after a sandbox is created or refreshed, and Salesforce lists "sanitizing" records as a use. It's free and runs without anyone clicking anything. The costs are maintenance (every new sensitive field means a code change) and access: the script runs as the Automated Process user, which doesn't have access to every object and feature.
2. A third-party masking product. Several vendors mask Salesforce data, either inside the org or by masking an extract before loading it. Compare them on whether masking is deterministic (the same input always gives the same output, so relationships survive) and on what happens between refresh and mask. Our masking tools comparison covers the categories.
3. Mask during the copy, not after it. Instead of refreshing a Full or Partial Copy sandbox and then masking it, copy a filtered subset of production into a sandbox you already have and mask it on the way in. The sandbox never holds raw production values, even briefly. This is how Syntharil's data masking works. Masking is deterministic, so a masked email matches everywhere it appears, and email, phone and SSN-type fields are detected automatically. Be clear about the trade-off: it doesn't mask data that's already sitting in a Full sandbox, and it doesn't copy Chatter, User records or field history. It replaces the refresh-then-mask workflow rather than plugging into it.
4. Don't copy production at all. For development and many test scenarios, schema-valid synthetic test data avoids the masking question entirely, because there's no real PII to protect.
| Approach | Masks when | Deterministic | Cost model | Best for |
|---|---|---|---|---|
| Data Mask & Seed | After data lands in the sandbox | Not documented | Add-on (listed at 10% of net spend) | Teams staying on Salesforce's native path |
Apex SandboxPostCopy |
Right after refresh | Only if you code it | Free (your time) | Small orgs with few sensitive fields |
| Third-party masking product | Varies by product | Varies | License | Teams with existing vendor tooling |
| Mask during copy (e.g. Syntharil) | In transit, before data lands | Yes | Subscription (free in beta) | Teams refreshing sandboxes often from production |
| Synthetic data | Not needed | n/a | Varies | Development and automated tests |
What should you do this quarter?
- Now: list every sandbox that relies on Data Mask and its next refresh date. Ask your account team about Data Mask & Seed licensing.
- November: choose your path. If it's Data Mask & Seed, rebuild and test the policies. If it's an alternative, run it against a real sandbox.
- Before December 31: switch over, check a freshly refreshed sandbox for unmasked PII, and uninstall the managed package.
- First refresh in January: confirm the new process masked everything before giving anyone access.
Bottom line
Data Mask is already unsupported and goes read-only on December 31, 2026. Your configurations won't migrate themselves, so the work is rebuilding and testing, whether you move to Data Mask & Seed or something else. Start with your refresh calendar: the first Full or Partial Copy refresh after December 31 is your real deadline. For a wider look at the options, see how to mask PII in Salesforce sandboxes.
FAQ
When does Salesforce Data Mask retire?
Salesforce ended support for the Data Mask managed package on July 9, 2026, and the package becomes read-only on December 31, 2026. Some Salesforce pages still describe December 31, 2026 as the end-of-service date, so plan to be off the package before then.
What replaces Salesforce Data Mask?
Data Mask & Seed, which has been available to all customers since the Summer '26 release on July 18, 2026. It runs as a core app rather than a managed package, adds proactive PII detection and seeding from production, and can run mask or seed jobs on a schedule.
Do my Data Mask configurations migrate automatically?
No. Salesforce's guidance is to create new masking policies in Data Mask & Seed to replace your existing configurations. Custom libraries don't need to be recreated, and you can run both products in the same org while you transition.
Is Data Mask & Seed free?
Salesforce's pricing page lists Data Mask & Seed as an add-on at 10% of net spend for Enterprise and Unlimited editions. Whether an existing Data Mask license covers it isn't stated publicly, so confirm with your Salesforce account team.
What happens to sandbox refreshes after December 31, 2026?
Salesforce hasn't said exactly what read-only means for running mask jobs. Data Mask runs after a sandbox is created or refreshed, so a refresh copies unmasked production data until a mask job runs. Plan as if legacy mask jobs won't run after December 31, and have a replacement ready before your next Full or Partial Copy refresh.