Masking PII/PCI in Motion: Real-Time Data-Loss Prevention with Kafka and Flink on Confluent Cloud
Leo Bombonato, Blip.aiErick Da Silva, Datatchê
Thu, Nov 5, 10:30–11:15 AMRoom 2000
Most data-loss prevention happens after the fact — batch scans, nightly jobs,
audits that find the leak days later. But sensitive data leaks in motion: an
SSN typed into a free-text "notes" field rides a Kafka topic to a dozen
downstream consumers within seconds. This session shows how we shifted DLP left,
into the stream itself, so PII and PCI are detected and masked before a record
ever lands in a downstream system — a pattern we took from lab to a real client
engagement.
We walk through a production-shaped pipeline: customer records flow into
Confluent Cloud Kafka; Confluent Cloud for Apache Flink runs streaming SQL that
calls a custom Java UDF; the UDF calls an external DLP API (Nightfall) to find
SSNs, credit cards, and emails hidden in free text.
High-confidence findings are masked inline (last four digits kept) and attached as a structured findings object; lower-confidence hits are routed to a separate review topic for a human
analyst instead of being silently dropped or over-redacted. Per-call latency is
tracked per record and aggregated per minute, so the cost of "scanning in the
stream" is observable, not a black box.
On technical depth, we cover calling an external API from inside a Flink UDF
(Confluent's External Connectivity for UDFs), keeping secrets in a managed
connection, a fail-open design so a DLP outage never crashes the stream,
structured ROW return types matched to a JSON Schema sink, and the whole pipeline
provisioned as code with Terraform and a single Makefile.
Audience takeaways: a concrete pattern for in-stream redaction and tokenization,
how to balance automated masking against human review to control false
positives, how to budget the latency and cost of an external call per event, and
an honest account of what broke when we shipped it to a client.
By attending this session, your contact information may be shared with the sponsor for relevant follow up for this event only.
Speakers
-
Leo Bombonato
Sr. Eng. Mgr. Studio (AI Agents) & Data Products, Blip.ai
Leo Bombonato is a senior engineering leader with over 15 years of experience in web software development, engineering management, artificial intelligence, data analytics, and scalable architectures. He currently serves as Head / Senior Engineering Manager of AI Agents, Data Analytics & Scalability at Blip, where he leads multidisciplinary teams focused on AI scalability, data scalability, software architecture, security, back-end systems, and front-end scalability.
Before joining Blip, Leo was a founding engineer and AI Advisor at Stilingue, contributing to the company from its early stages through its acquisition by Take Blip. At Blip, he also served as Senior Tech Manager of Professional Services, leading a high-performance, multidisciplinary technical team focused on solutions across chatbot development, user experience, data, and artificial intelligence. In this role, he oversaw three managers and a team of 373 analysts organized into more than 40 squads, delivering projects for over 40 clients and driving technological advancements to meet diverse business needs.
Over his career, Leo has led engineering, innovation, professional services, and solution engineering teams, managing complex technology initiatives across multiple business units. He holds a Master’s degree in Computer Science from the Federal University of Ouro Preto, with a focus on Artificial Intelligence, Computer Vision, Digital Image Processing, and Pattern Recognition. His academic work includes research and publications in real-time brand logo recognition and social media analysis.
Passionate about entrepreneurship, technology, and innovation, Leo combines deep technical expertise with strong leadership experience to build scalable products, empower engineering teams, and deliver impactful solutions for customers and businesses. -
Erick Da Silva
CEO, Datatchê
I am a Senior Data Architect and Data Engineer with extensive experience designing scalable, cloud-agnostic data ecosystems across Azure, AWS, Databricks, and OCI. Over more than twelve years in the field, I have specialized in ETL/ELT architectures, streaming pipelines, data governance, and analytics-ready platforms—consistently turning complex data scenarios into simple, high-value business solutions.
My technical foundation is deep and hands-on, spanning Databricks, Apache Kafka, Apache Spark, Apache Flink, Synapse, Data Factory, Delta Lake, SQL, Python, Scala, and Power BI. A recurring theme throughout my career has been the modernization of traditional batch workloads into near-real-time streaming solutions, reducing both latency and operational costs while strengthening data quality and governance.
I am the founder and CEO of Datatchê, a data-focused consultancy I launched in July 2022 with the mission of delivering cloud-agnostic technological solutions that give clients freedom and flexibility. Under my leadership, Datatchê has become an official partner of Confluent, IBM, Databricks, Microsoft, AWS, GCP, Ververica and more, operating on high-impact projects in Brazil and internationally. I lead the company’s strategy, innovation, and client and partner relationships, while staying directly involved in the technical delivery of critical projects across data engineering, scalable architecture, and systems integration.
My earlier career traces a steady progression through increasingly senior roles. At GAVB, I advanced from Senior Data Engineer to Data Engineer Specialist and ultimately Lead Data Engineering, where I architected and led teams on major Azure and GCP projects for clients such as Lojas Renner, GetNet/Grupo Santander, CCR (Motiva), and MRS. Before that, I held data engineering and business intelligence roles at DBC and Business Tech, delivering data warehouses, data lakes, and ETL solutions for a wide range of enterprise clients—including a memorable optimization that cut a SQL Server procedure’s runtime from three hours to three minutes.
I hold a Bachelor’s Degree in Systems Analysis and Development from IFRS, complemented by technical training from Data Science Academy and Udacity. I maintain a current portfolio of industry certifications, including Databricks Data Engineer Associate and Data Analyst Associate, and Confluent’s Data Streaming Engineer credentials, including Apache Flink. I am fluent in Portuguese as my native language, advanced in English, and conversational in Spanish.
As both a founder and a practicing engineer, my defining strength is the rare combination of strategic leadership and deep technical execution—empowering organizations to treat data not as a byproduct, but as a true engine of business value.