Brume: FK-safe pseudonymization for PostgreSQL test and debug copies

Brume 2.1, an open source (Apache 2.0) tool that creates deterministic, foreign-key-safe pseudonymized copies of PostgreSQL databases for testing, debugging and demos, is now available.

Why Brume?

Development teams often need realistic data to reproduce bugs, run tests or prepare demos, but copying production exposes real personal data. Classic masking scripts also tend to break referential integrity, which forces you to disable triggers, suspend constraints or repair broken joins by hand.

Brume copies a targeted subset of a source database to a target database or to a .sql file, and transforms personal data on the fly, before anything is written. Foreign keys stay valid end-to-end on the target. Brume only reads from the source database.

Key features

• Column-level strategies: FAKE for realistic synthetic values, MASK for partial reveals, HASH for one-way hashing, NULLIFY to drop sensitive data, FPE_ID / FPE_UUID for format-preserving encryption of identifiers, and DATE_SHIFT to move dates while keeping their distribution.
• Deterministic output: transformations are keyed by your own secrets. The same input with the same secret always gives the same output, across all releases of a major version, so test fixtures and debug sessions stay stable from one run to the next.
• Referential integrity: format-preserving encryption rewrites primary keys and the foreign keys pointing to them consistently. With linked_columns, a value shared between tables that have no formal foreign key (for example, an email in both users and audit_logs) gets the same pseudonym everywhere.
• Subsetting: define row-level filters on any table (created_at >= '2025-01-01', tenant_id = 42...). Brume follows foreign keys up to a configurable depth, towards parents and children, to produce a small, self-contained and coherent extract.
• Declarative configuration: a single brume.yml file describes the strategy for each table and column, with semantic types (EMAIL, PHONE, IBAN, ADDRESS...) and JSONB paths to target nested fields. The file can be version-controlled and reviewed like code before any run.

GDPR

Pseudonymization is one of the measures cited by GDPR Articles 25 and 32. Brume gives DPOs and security teams a reviewable, auditable description of how personal data is transformed before it leaves production.

Compatibility and installation

Brume supports PostgreSQL 12 to 18. Packages are available for Debian/Ubuntu (apt), RHEL/Fedora (dnf) and macOS (Homebrew).

Links

• Website and documentation
• Quickstart
• Source code
• Releases