Local-first data masking
ShiftMask builds a safe local copy of your Excel and CSV files — table relations intact, every date shifted by one offset, every name masked. The real records never leave your machine.
Windows · works with Wi-Fi off
| customer_id | name | invoice_date | amount |
|---|---|---|---|
| C-10482 | Nowak Logistics | 2026-08-14 | 18,420.00 |
| C-10483 | Baltic Foods | 2026-08-15 | 4,990.50 |
| C-10482 | Nowak Logistics | 2026-08-28 | 7,110.00 |
| customer_id | name | invoice_date | amount |
|---|---|---|---|
| ID_7f3a2c9e | Lis sp. j. | 2025-10-29 | 25,235.40 |
| ID_b41d06a2 | Wróbel S.A. | 2025-10-30 | 6,836.99 |
| ID_7f3a2c9e | Lis sp. j. | 2025-11-12 | 9,740.70 |
0
Bytes sent to any server
No account, no upload, no telemetry. ShiftMask reads your files, builds the masked copy in a local DuckDB database, and writes it back to your disk. Pull the network cable and it still works.
Where it sits
ShiftMask sits between your files and everyone who helps you build on them. Only the masked copy goes out. Only the finished work comes back — and it runs on your real data.
Excel or CSV files, read on your machine. It works with Wi-Fi off.
Names and IDs get consistent stand-ins, every date moves by one offset, keys still join.
AI assistants and BI developers build, prototype and quote on realistic data.
Point the finished report or code at your real data. It runs unchanged.
What survives
Most tools scramble values row by row. That destroys exactly the properties a model needs in order to write code that runs against your real database later.
Referential integrity
Keys are masked identically in every table, so joins, lookups and relationships still resolve.
Time intelligence
One shared offset moves the whole calendar. Intervals and period boundaries hold, so YTD, YoY and rolling averages return the same shape.
Cardinality and shape
Row counts, distinct counts and value distribution stay realistic, so the code is sized for your data, not a toy sample.
Proportions between amounts
Every amount in a group is multiplied by the same hidden factor, so totals, shares, ratios and trends keep their shape.
Clients, products and people
Company names, product labels, people, emails, phone numbers, account numbers and identifiers become consistent stand-ins — the same original always gets the same stand-in, in every file and every run. The map back to the originals stays encrypted in a vault on your machine.
The real figures
Nobody reading the copy sees what anyone actually paid. Rescaling hides the figures from a reader, not from someone who already knows one real amount in that column — we say so plainly.
The method
Excel workbooks or CSV files. ShiftMask reads their structure and detects primary and foreign keys to map how your tables actually connect. You confirm or correct the map. SQL databases come with Pro.
Every date moves by one project-wide offset. Names, emails and identifiers become generated stand-ins — the same input always yields the same output, so one customer stays one customer across every file.
Send the safe package to ChatGPT, Claude, Gemini or a coding agent. You get back a dashboard, report or app. Point that code at your real data offline and it runs unchanged.
Built for
The analyst
You already use AI to write DAX, SQL and Python. You also know that pasting a client extract into a chat window is the kind of thing that ends a contract. ShiftMask gives you something you can paste.
The owner
You want a report or a small internal tool without hiring anyone for three months. You are also the person who signs the data processing agreement. ShiftMask keeps the real records where they belong.
Pricing
One licence for what ships today. Two more tiers are on the way, priced so that starting with Core never costs you anything later.
Available now
Core
One person, one machine, Excel and CSV.
$39
One payment, per device
Free updates for 1 year
Founding price — first 150 licences
Download, install, then activate seven days of the full product. No email, no card. Buy when it has earned it.
Coming soon
Pro BI Bundle
The analyst whose AI assistant needs a whole database, not a folder.
$89
Planned price
One payment, per device
Upgrade from Core — 50 USD
Coming soon
Team Enterprise
Several people, one person keeping track of the licences.
$35
Planned price
Per seat, per month
or 350 USD per seat, per year
Over 20 seats? Talk to us.
Buying Core today does not make you a second-class customer later. What you pay for stays yours for good, and upgrades are priced as the difference, not as a fresh purchase.
Team is the only tier sold as a subscription, and deliberately so: it is the only one where you keep receiving something — model updates and seat management — rather than a set of features that is yours once you buy it.
Download
ShiftMask installs for your user only, so you do not need administrator permissions. If your work laptop blocks installers outright, take the portable build instead — unzip it and run it.
The installed version updates itself. The portable one does not — you come back here for the next release.
On a managed work laptop? Send your IT department this page — what it installs, what leaves the machine, and how to check the signature.
Installed it? You will need a licence to do anything with it — start a free 7-day trial, no email address required.
Before it runs
There are two steps, and the first one hides the second. This is what you will see and where to click.
Windows protected your PC
Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk.
More info
Windows protected your PC
Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk.
Why does Windows do this? The file is signed by 4optima. The warning is about reputation — a new release simply hasn't been installed by many people yet. How to verify the file yourself ↓
Uses Microsoft Edge WebView2 Runtime · if it is missing, ShiftMask asks and installs it for you
Edge or Chrome may report that the file could not be scanned. Open the downloads list, click the three dots next to ShiftMask-win-Setup.exe, and choose Keep.
Right-click the installer, choose Properties and open the Digital Signatures tab: it should name 4optima Sp. z o.o. From PowerShell, Get-AuthenticodeSignature .\ShiftMask-win-Setup.exe should return Valid. That tells you more about a file than any warning dialog does — and it is the same check your IT department will run.
Before you trust it
Yes — seven days with the full product. Every feature, no row limits, no watermark on the output. It is the same build you would buy, with a licence that expires. No purchase, no email address, no account: install it, copy the device ID it shows you, and paste it into the page.
We dropped the idea of a permanently free edition with file and row limits. A limited version answers the wrong question — it tells you whether ShiftMask runs, not whether it survives your actual data. Seven days on your own files answers the question you have.
Not the real data. Anything you paste leaves your control, and most public AI tools give you no contractual guarantee about where it goes. ShiftMask exists so you never have to — you send a structurally identical copy in which no value is a real name, account or identifier, and you get working code back all the same.
Two different things get called Copilot, and they need different answers.
If it means pasting a real spreadsheet into Copilot and asking it to anonymise the contents — by the time it can do that, the data has already left your machine. The masking happens after the exposure instead of preventing it. ShiftMask runs before anything is sent, and that is the whole difference.
If it means Microsoft 365 Copilot with enterprise data protection, the guarantee is real and worth having: your prompts stay inside your tenant and are not used to train foundation models. But it answers a different question from the one a client contract asks. An NDA is usually about where a client’s data may be processed and who may see it, not about whether a model trains on it. If you hold data for several clients, or for one whose contract names the systems their data may enter, “it stayed in our tenant” is an argument you have to make and win. With a masked copy there is no argument to make, because what you pasted was not their data.
For the practical side of Copilot inside Excel, see How to use Copilot in Excel safely with sensitive data.
You can ask, and people do. What comes back is a best effort, not a guarantee. A language model works through a workbook the way it reads text: it can stop part-way, skip rows, or treat the same customer differently in two places — and it says it is done when it believes it is.
One analyst told us exactly that. He asked Copilot to anonymise the personal data in a workbook, then asked whether it had done everything. It checked, found it had not, and did more. It took more than four rounds, and he still had no way to know whether the last round was the last.
ShiftMask works the other way round. Before anything runs, you see every column and what will happen to it. Every value in every column you chose is then processed in every row, the same way every time, and the report at the end says what was done — including any cell that could not be converted. The question you are left with is not “did it finish?” but “did I pick the right columns?”, and that one you can check with your own eyes.
And there is the earlier point: to have a model anonymise a file, you first have to give it the file.
Possibly, and the honest answer has three parts.
The installer needs no administrator rights. It installs for your user only and writes nothing to Program Files. That settles the technical question, but not the policy one.
If the policy is about installers specifically, take the portable build instead: unpack the ZIP, run the file inside. No installer, no registry entry, nothing written outside the folder you unpacked it into.
If the policy is about running any unapproved program — and in the kind of organisation that needs this tool most, it usually is — then someone has to approve it, and the way through is to ask rather than to go around. We wrote the page for that person: what your IT department will ask. It covers what gets installed and where, exactly what leaves the machine and what does not, how to verify the code signature yourself, and which third-party components ship inside.
No. ShiftMask is a desktop application. It reads your files locally, builds the masked copy in a local DuckDB database, and writes the output to your disk. You decide what, if anything, gets sent anywhere.
That is the specific failure ShiftMask was built to avoid. Random date replacement destroys intervals, which breaks YTD, YoY and every rolling calculation. ShiftMask moves every date by one shared offset instead, so the distance between any two events is unchanged and time-based measures return the same shape.
Open the workbook in ShiftMask, confirm which columns hold personal data — it proposes a classification automatically — and export. You get a new workbook with the same sheets, columns and relationships, and with names, identifiers and dates replaced by consistent stand-ins. The map back to the real values stays in an encrypted vault on your machine — that is what lets you swap the real data back in later, and it is why the export is pseudonymised rather than irreversibly anonymised.
No tool can make that promise for you, and be careful with any that does. What ShiftMask does is replace the personal data in the copy you share with stand-ins, which is usually the hard part of using public AI tools lawfully. Because the map back is kept — encrypted, on your machine — that copy is pseudonymised under GDPR rather than anonymised, so it remains personal data. Your obligations under GDPR, and under HIPAA if you work with health data, still depend on your own processes.
Yes — within 14 days, no questions asked. Write to shiftmask@4optima.pl and we will arrange it. Your purchase is handled by Lemon Squeezy as merchant of record, so the money comes back through them.
One thing worth saying plainly: a licence token, once issued, cannot be revoked. It is verified entirely offline, which is exactly what lets ShiftMask run on machines with no internet — and the price of that is no kill switch. After a refund we are relying on you to stop using it. We would rather ask than break offline activation to prevent it.
You get a new token, at no charge, and there is no limit on how many times. Hardware fails and laptops get stolen; a limit would punish the people that happens to without stopping anyone acting in bad faith.
ShiftMask prepares the whole request for you — there is a transfer button on the activation screen, which is where you will be if the old machine is already gone. Send it from the address you bought with, since that is what links the request to your order, and you get a new token within one working day. A person handles this rather than an automatic system: self-service would mean keeping a record of every activation on our server, which is precisely what this product promises not to do.
Those are built for test environments, priced for enterprise budgets, and usually run as a service. ShiftMask is a desktop app for one person with one project and a deadline, sold for one payment, and it never sends your data to a server.