--- title: "De-identified analytics - Stacksync" description: "Mask PHI at the field level and push safe datasets to Snowflake for BI, so analysts get clean data without ever touching protected health information." canonical: https://www.stacksync.com/use-case/de-identified-analytics last_modified: 2026-07-05 --- Stacksync × Supabase Miami: **AI-Native Operations** Oct 13 [Reserve your spot](https://www.stacksync.com/events/2026-10-13-supabase-miami) Field-level PHI masking on every record # De-identified analytics without exposing PHI Apply field-level masking as records leave Epic, Cerner, or your EHR and stream the de-identified result into Snowflake or BigQuery in real time, so analysts build dashboards without protected health information ever leaving the boundary. [Book a demo](https://www.stacksync.com/book-a-demo) [Talk to a solutions architect](https://www.stacksync.com/book-a-demo) ## Adopted by fast-scaling companies moving mission-critical data in real time - Gladia Case study - IDEXX - MedPro Migrated from MuleSoft - Eko Case study - Ubicloud - Vimeo - Codility Migrated from Celigo - ACERTUS Migrated from Heroku Connect - Syringa Migrated from Matillion - Truora - Streaam Case study - SEAL SQ - Rinsed Migrated from Fivetran - IA Capital Group Case study - Meter - Golden Pear Funding Migrated from Celigo Where analytics pipelines expose PHI ## Three reasons safe data turns risky. Moving clinical data to a warehouse usually means copying everything and trusting downstream controls. That's where PHI slips into places it shouldn't be. 01 - Copy everything ### Raw PHI lands in the warehouse Most ETL jobs lift full tables from Epic into Snowflake, names and MRNs included. Now every analyst with warehouse access can read identified patient data they never needed. COMPLIANCE 02 - Masking too late ### De-identification happens after the leak Teams mask inside the BI tool, after the raw extract already sat in staging. The window between landing and masking is exactly where an audit finds exposure. DATA QUALITY 03 - Stale snapshots ### Dashboards run on last week's data Nightly de-id batches mean clinical and operational dashboards always trail reality. Decisions get made on a snapshot that no longer reflects the floor. LATENCY PLATFORM ## Six products. One Platform. Replace many legacy vendors. Every tool Stacksync replaces is one fewer vendor, one fewer bill, one fewer integration to maintain. [Start building now](https://www.stacksync.com/book-a-demo) ### [Two-way sync](https://www.stacksync.com/two-way-sync) Changes made in one platform automatically update across all connected systems in real time, eliminating data silos and reducing errors. Replaces: Heroku Connect and Salesforce Data 360 Heroku Connect Salesforce Data 360 ### [Workflow automation](https://www.stacksync.com/workflow-automation) Stop building brittle API scripts. With Stacksync, you can trigger complex automated workflows using simple SQL commands. Replaces: Workato and Boomi ### [AI Agents](https://www.stacksync.com/ai-agents) Expose every enterprise system to your agents through a single MCP layer. Claude, ChatGPT and Gemini get production-grade tools without custom glue code. Natively available in: Claude and ChatGPT and Gemini Claude ChatGPT Gemini ### [Event queues](https://www.stacksync.com/event-queues) Handle massive traffic spikes without losing a single event. Queues buffer your data during surges, ensuring strict ordering and reliable delivery. Replaces: Kafka and Amazon SQS and Confluent Kafka Amazon SQS ### [Database hosting](https://www.stacksync.com/database-hosting) Interact with your CRM, ERP, and payment tools as if they were just another table in your database. Say goodbye to rate limits and complex API documentation. Replaces: AWS RDS and Self-hosted databases AWS RDS Self-hosted databases ### [EDI](https://www.stacksync.com/edi) Transform legacy EDI complexity into simple database interactions. Stacksync automatically parses incoming EDI documents directly into your database tables. Replaces: SPS Commerce and TrueCommerce [Start building now](https://www.stacksync.com/book-a-demo) Connectors ## Every source a dataset draws from, masked on the way out. Stacksync ships pre-built connectors for the EHRs and operational systems analytics pulls from, applying field-level masking and tokenization before data reaches the warehouse. Clinical sources 05 - Epic - Cerner - athenahealth - eClinicalWorks - Redox Operational sources 05 - Workday - NetSuite - Salesforce - Microsoft 365 - Veeva Warehouses & BI 05 - Snowflake - BigQuery - Databricks - Postgres - MongoDB Governance & alerts 05 - Slack - Twilio - SendGrid - Oracle DB - FHIR R4 Custom masking rules, tokenization keys, and per-field PHI policies are first-class, no scripting required. [Browse all 1,000+ connectors](https://www.stacksync.com/connectors) SECURITY ## Security teams trust Stacksync As a data company, we understand the importance of keeping your data secure. Stacksync is built with security best practices to keep your data safe at every layer, and is DPF-certified for US, EU, UK and CH data transfers. [Learn more about security](https://www.stacksync.com/security) | | | | --- | --- | | | SOC 2 Type II | | | ISO 27001 | | | HIPAA BAA | | | GDPR | | | CCPA | | | DPF US-EU-UK-CH | → SECURITY WITH BENEFITS ### SSO & SCIM Let your users access Stacksync from your centralized user management systems. Works with Okta, Azure, Google SSO and more. ### Alerts Immediately get alerted about record syncing issues over email, Slack, PagerDuty and WhatsApp. Resolve issues from a centralized dashboard with retry and revert options. ### Secure connection options Securely connects to your systems with: [OAuth 2](https://www.stacksync.com/security) [SSH Tunnelling](https://docs.stacksync.com/two-way-sync/connectors/setup-options/ssh-tunneling) [SSL certificates](https://docs.stacksync.com/two-way-sync/connectors/postgres/authorize-postgres/amazon-rds/ensuring-secure-rds-connections-with-ssl-certificate) [IP Whitelisting](https://docs.stacksync.com/two-way-sync/connectors/setup-options/ip-whitelisting) [VPN gateway](https://docs.stacksync.com/two-way-sync/legal/service-consumption-tables#:~:text=%E2%9C%93-,VPN%20gateway,-%2D) [VPC peering](https://www.stacksync.com/security) and more Common questions ## Common questions about de-identified analytics. The concerns every data and compliance team raises before pushing clinical data into a shared warehouse. [Talk to a solutions architect](https://www.stacksync.com/book-a-demo) ### Where does de-identification actually happen? In the pipeline, before the record reaches Snowflake. Masked, hashed, or tokenized values are written to the warehouse; raw PHI never lands in staging or BI. ### Can we keep referential joins after masking? Yes. Consistent tokenization replaces an MRN with a stable surrogate key, so analysts still join encounters and outcomes across tables without ever seeing the real identifier. ### How fresh is the de-identified data? Real-time. Records mask and stream as they change, sub-second on event sources and 1–60s on polled ones, so dashboards reflect the floor instead of last night's batch. ### Is the masking itself auditable? Yes. Every field-level policy decision is logged per record, so you can prove to an auditor which fields were masked, tokenized, or dropped before data left the boundary. ## Stop copying PHI into BI. Ship safe data in real time. [Book a demo](https://www.stacksync.com/book-a-demo) [Get started](https://app.stacksync.com/)