Anonymized production clones for staging

The idea

Every SaaS team eventually needs staging data that behaves like production: same skew, same weird edge cases, same ten-million-row table. The lazy answer is copying prod, which means every developer laptop holds real customer PII, which is a GDPR problem, a SOC 2 audit finding, and a breach multiplier. The diligent answer is a hand-rolled scrubbing script that breaks the week someone adds a column.

Tonic and Neosync validate the market at enterprise prices and enterprise onboarding. The wedge is shape: one config file, one nightly pipeline, no data platform. The technical detail that makes it actually usable is deterministic scrubbing, the same real email always maps to the same fake email, so joins, foreign keys and login-by-email flows keep working in staging.

Who pays

The buyer is a 5 to 50 person SaaS team with SOC 2 or GDPR pressure, usually triggered by an auditor or an enterprise customer’s security questionnaire asking how staging data is handled. At 99 to 299 dollars a month it is dramatically under incumbent pricing and sells to the CTO directly. Distribution: SEO on anonymize postgres for staging, SOC 2 preparation communities and consultants, and content about the audit finding itself.

MVP scope

• Schema introspection with suggested column classification (email, name, phone, card, free text)
• Review UI producing a single exportable YAML config
• Streaming pg_dump pipeline with deterministic HMAC-based value rewriting that preserves joins
• Scheduled nightly runs with restore to staging and row-count verification
• Self-hosted Docker worker option with hosted control plane
• Skip for v1: MySQL/Mongo, subsetting (shrinking the database), synthetic data generation, per-developer ephemeral clones, differential/incremental sync

Build ScrubClone, a service that produces anonymized nightly clones of production Postgres databases for staging. Stack: Next.js dashboard, Postgres for app state, Docker-packaged worker that runs the clone pipeline, Stripe for billing.

Core flow: user connects a source database (read-only credentials or a pointer to nightly dumps in their S3 bucket) and a destination (their staging database or an S3 path for the scrubbed dump). ScrubClone introspects the schema and proposes a column classification: email, person name, phone, address, card/PAN-adjacent, free-text notes, based on column names, types and sampled values. The user reviews and confirms each column's treatment (scrub, keep, nullify, truncate table) in a mapping UI; the confirmed config is exportable as one YAML file that fully drives the pipeline and can live in their repo.

The nightly worker streams pg_dump output through a rewriter that replaces flagged values deterministically: same input always yields the same fake output via HMAC-seeded generation, so foreign keys, joins and email-based lookups still line up across tables. Then it restores to the destination and runs row-count sanity checks against the source.

Pages: landing, connection setup wizard, classification review UI with sample values shown masked, run history with per-table row counts and duration, config export, billing.

Implementation notes: never persist source data on ScrubClone infrastructure; the worker streams. Offer a self-hosted worker mode (their Docker host, our control plane) for compliance-sensitive buyers.

Pricing: 99 GBP/month one database, 299 GBP/month five plus self-hosted worker.