Almost every vendor in this category publishes benchmark numbers. This is a report from a real operating company's live ERP — a 36-year-old furniture business with an actual customer table — including the places where the report is weaker than it looks.
On 12 July 2026 at 10:58 UTC, the full customer table of our own family company's production ERP was read (read-only) and passed through Conarium's real Governance.redact() path. Raw personal data was never written to disk at any point. The run produced 123 audit lines: 121 batches of 1,000 records, one final batch of 374, and one summary line.
The arithmetic is checkable from the audit file alone: 121 × 1,000 + 374 = 121,374 records, and 121 × 4,000 + 1,496 = 485,496 masked fields. Those two independent sums matching the summary line is the first thing you should verify, because it is the cheapest way to catch a fabricated report.
121,374 records produced 121,366 identities. The 8-record gap is records that yielded no identity token. We have not yet traced why for each one — most likely rows with no name populated. We are stating the gap rather than rounding it away; if you want the precise cause, ask and we will go find it.
The audit log is hash-chained: each line carries the hash of the previous one, and the first line starts from 64 zeros. On 29 July 2026 — 17 days after the run — the chain checker that ships in the repository was run against the same file:
$ node scripts/audit-chain-check.mjs audit-cariler.jsonl exists: true · bytes: 46667 · lines: 123 prevHash breaks: 0 self-hash mismatches (tamper suspicion): 0 ok: true $ echo $? 0
Zero breaks, zero mismatches. No line was edited, deleted or reordered between 12 and 29 July.
The chain proves the log was not altered after the fact. It does not prove the masking was correct at the moment it happened, and it does not prove nobody bypassed Conarium and read the table directly. Those are different guarantees and we are not going to blur them. The signature on this log is HMAC, which is symmetric — so today this is internal consistency, not third-party non-repudiation. Asymmetric signing is being built now; when it lands, a third party will be able to verify this without trusting us at all.
The first run of this measurement reported 1 leaked value. It was wrong, and the way it was wrong is worth publishing.
The leak detector was searching for each raw value anywhere in the row's JSON. A short fragment of a phone number happened to appear inside an unrelated internal numeric ID, so the check fired. It was reproduced locally with a synthetic case, the detector was rewritten to compare field by field, exact match, and the run was repeated clean.
The masking engine had made no mistake at any point. The measuring instrument was broken, not the product. We are publishing this because a governance report that has never reported a problem with itself is not a report, it is an advertisement.
The audit summary line contains a source field naming our internal ERP database and table. We have redacted it here to codes:<internal-erp>.<customers-table>.
It is our own schema, not a customer's, so the risk is low — but publishing your own internal object names in a public document is exactly the habit our product exists to break. We caught the same class of leak in our public demo on 17 July, where a table description still read "ZION mirror (Codes sync)" and exposed an internal system name to demo visitors. It was fixed with a regression test. Applying the rule to ourselves in this report costs nothing and the alternative would be embarrassing.
full-run-2026-07-12, a batch identity. Per-user attribution does not exist in Conarium yet. Do not read this report as evidence of who accessed what.The engine that produced these numbers is MIT licensed and public. You cannot run it against our ERP, but you can run it against yours:
git clone https://github.com/dogrucanemek-alt/conarium.git cd conarium && npm install && npm run build # Masking + audit chain, no database required npx tsx demo.ts # Verify any audit file, including your own node scripts/audit-chain-check.mjs path/to/audit.jsonl
Or attach the public demo endpoint to your own Claude and watch the masking happen in your own tool: conarium.dev/#trylive.