Selective Data Distribution (SDD) allows masked data to be distributed between CD engines without requiring a full copy of the unmasked parent source environment. SDD determines the specific data blocks needed to represent the masked VDB and transfers only those blocks to the target engine. In DCT, SDD is managed through replication policies — navigate to Data > Policies > Replication and select the Selective Data Distribution mode.

You can run SDD ad hoc, but it is typically run according to a predefined schedule configured in the replication policy parameters. After the initial update, each subsequent update sends only the changes incurred since the previous update. SDD does not provide synchronous semantics, meaning that the data distributed to the target is only as current as of the most recent update.

Features

In addition to the replication capabilities provided by the underlying infrastructure, SDD permits the distribution of masked data between CD engines. The sources received on a target CD engine do not include the original parent source, thereby making the original source inaccessible from the target.

SDD is configured through DCT replication policies on the source CD engine. It first copies a subset of masked VDBs to a target engine, then sends incremental updates either manually or according to a schedule. Sensitive data from the production data center is brought into Delphix as a dSource. The Masking Engine then masks the dSource data as a VDB. DxFS redacts the sensitive data within that dSource before sending it to the non-production datacenter using Delphix Replication. Using SDD, sensitive data is never exposed because it is protected both at the dSource and VDB layers.

You can use replicated masked VDBs to provision new VDBs on the target CD engine. The provisioned VDBs contain the data in their masked parent and are therefore also considered masked. You can refresh these VDBs to snapshots sent as part of an incremental replication update, as long as you do not destroy the parent object on the replication source. For more information, see Provision from replicated dSources or VDBs.

During replication, replicated masked VDBs are maintained in an alternate replica and are not active on the target side. The failover of an SDD replica is not supported.

Details

When you select masked objects for SDD, the engine will automatically include any dependencies, such as environments, associated with the VDB. The parent dSource and any parent VDBs are not included. The data associated with parent objects are selectively included for disk space efficiency, but data in the parent dSource and VDBs that the masked VDB does not need are excluded.

While SDD may reduce the amount of data sent, it does not eliminate all parent or dSource data. Any blocks referenced by the masked VDB including some from parent snapshots or upstream VDB lineage will still be included. Space savings may come from excluding blocks and snapshots that are not referenced by the masked dataset, rather than excluding entire parent objects.

During replication, the CD engine negotiates an SSL connection with its server peer to use TLS_AES_128_GCM_SHA256 as the cipher suite, and TLSv1.3 as the protocol.

Only database objects and their dependencies are copied as part of an SDD operation, including:

  • Masked VDBs

  • Environments

  • Environment configuration (users, database instances, and installations)

The following objects are not copied as part of an SDD operation:

  • Parent dSources of masked VDBs (the storage blocks for non-sensitive dSource data are sent from the source to the target replication host; this storage is displayed under Held Space)

  • Groups of the parent dSources

  • Users and roles

  • Policies

  • VDB (init.ora) configuration templates

  • Events and faults

  • Job history

  • System services settings, such as SMTP

Resumable SDD

A single SDD instance can fail for a number of environmental and internal reasons. However, using the resume feature, you can restart SDD from an intermediate point; no data is retransmitted. SDD is resumable across machine reboot, stack restart, and network partitions. The resumable replication feature is fully automated and does not require or allow any user intervention.

SDD will not resume after failures that leave the source and target connected. For example, if a storage failure on the target (such as an out-of-space error) causes a distribution to fail, then the source and target remain connected. As a result, the engine will discard state data associated with the failed replication operation.

Restrictions

  • Only masked VDBs can be added to an SDD spec. You cannot add dSources, groups, or the entire domain.

  • Only masked VDBs with a Snapshot Policy of None should be added to an SDD spec.

  • Unmasked VDBs cannot be added to an SDD spec.

  • VDBs that undergo SDD and their children cannot be selectively redistributed to another target.

  • You cannot go to the target engine and create an SDD spec that includes VDBs that are present because of SDD. However, you can replicate this data using a traditional replication spec.

Delphix Masking and Delphix Virtualization must never be run inside the same virtual machine. Always use separate, dedicated Delphix Engines for Masking and Virtualization.

Supported platforms

SDD support is aligned with all environments supported by each data source. For more information, read Ecocsystem Hub documentation for your environment.

Last updated
Oct 8, 2026