Start with the free SDK a dead company left behind. If your security team will not let production data into a model-training pipeline, a test environment, or a vendor's cloud, the correct first move is not a procurement cycle. It is MOSTLY AI's Apache-2.0 Synthetic Data SDK, running locally on your own hardware, on one real table, to find out whether synthesis preserves the signal you actually need. That costs nothing but a week of an engineer's time, and it answers the only question that matters before you spend money.
The vendor behind that SDK ceased operations in March 2026 after raising $31.14 million, and Syntho acquired the MOSTLY AI brand on 9 June 2026. The code is still Apache-2.0 and still runs. That is the shape of this market in one sentence: the software is durable, the companies are not, and the privacy guarantee most buyers think they are purchasing is not on sale from anyone.
Synthetic data is artificial records generated by a model fitted to your real records, designed to reproduce the statistical structure of the original without copying individual rows. It is a risk reduction technique, not an anonymisation guarantee — and the difference is the entire subject of this page.
| Option | What it is | Runs inside your perimeter | Formal DP guarantee | Published price | Buy it for |
|---|---|---|---|---|---|
| MOSTLY AI Synthetic Data SDK | Apache-2.0 Python library, orphaned vendor | Yes — LOCAL mode or Docker | Yes, optional | $0 | Proving synthesis works before you buy anything |
| Tonic Structural + Textual | Commercial test-data platform | Yes — self-hosted in your VPC | Per-generator toggle, ε = 1 default | Contact sales (Fabricate from $29/mo) | Nightly refresh of dev/QA across many databases |
| NVIDIA NeMo Safe Synthesizer | DP-SGD microservice (ex-Gretel) | Yes — on your GPUs | Yes, whole-model DP-SGD | NVIDIA AI Enterprise; $18,000/GPU for 5 years list | A written epsilon you can hand a regulator |
| Syntho | Commercial on-prem platform, owns the MOSTLY AI brand | Yes — self-hosted engine | Claimed, no published ε | Contact sales | European buyers who want a vendor, not a repo |
| SDV (DataCebo) | Business Source Licence Python library | Yes | Only via add-ons | $0 for internal use | Multi-table and sequential experiments |
Snowflake GENERATE_SYNTHETIC_DATA |
Stored procedure you already own | Yes — never leaves the account | No | Included in Enterprise Edition | Low-stakes utility data, already in Snowflake |
| Masking (Oracle DMSP, PostgreSQL Anonymizer, Greenmask) | Deterministic transformation of real rows | Yes | Not applicable | $0 to $11,500/processor | Most test-data problems, honestly |
Prices checked 1 September 2026 against each vendor's own pricing page or licence listing. Normalise every quote you collect to the same workload before you compare them: a 40-column, 12-million-row customer table plus three child tables, regenerated nightly into three non-production environments, on infrastructure you control.
Three of the Four Best-Known Vendors Are Already Gone
The pure-play synthetic data market consolidated out of existence between November 2024 and June 2026, and your shortlist is probably built from articles written before that happened.
Hazy went first: SAS acquired its principal software assets in November 2024 and folded them into SAS Data Maker. Gretel followed, acquired by NVIDIA in March 2025. The gretel.ai domain now issues a 301 redirect to an NVIDIA use-case page, and the gretelai GitHub organisation carries a blunt banner: "This organization was marked as archived by an administrator on Feb 18, 2026. It is no longer maintained." The self-serve console is retired. What survives is two NeMo microservices — Data Designer for generation, Safe Synthesizer for privacy-preserving synthesis — behind an NVIDIA AI Enterprise licence.
MOSTLY AI was the third. CB Insights records $31.14M raised and an acquisition by Syntho in June 2026, following Austrian press reports that the company ceased operations in March 2026. Syntho bought the trademark and related assets; the announcement says the brand "will continue under the name 'MOSTLY AI, powered by Syntho'" and says nothing at all about existing customers, support continuity, or the SDK.
That silence is the lesson. If you had bought the MOSTLY AI platform in 2025, your renewal conversation in 2026 would have been with a different company, in a different country, under a contract that never contemplated the transfer. The same change-of-control exposure applies to every remaining private vendor in this table — it is the same pattern we traced when Oakley Capital bought Graphwise and buyers discovered GraphDB was never open source.
What this means for your shortlist: weight source-available software far more heavily than you normally would. The MOSTLY AI SDK is Apache-2.0 and runs in a LOCAL mode that "trains and generates synthetic data locally on your own compute resources." A dead vendor cannot take that away from you. SDV from DataCebo is close but not identical — read its licence before you standardise on it. It is a Business Source Licence with an Additional Use Grant that permits everything except running it "for a Synthetic Data Service," meaning you may use it internally but may not offer its capabilities to third parties outside your organisation. Change Date is four years from release, converting to MIT.
What "Privacy-Safe" Synthetic Data Actually Prevents
Synthetic data reliably prevents casual browsing of individual records. It does not reliably prevent a motivated attacker from reconstructing your outliers, and the research record on that is now four years deep.
The foundational result is Stadler, Oprisanu and Troncoso's Synthetic Data – Anonymisation Groundhog Day at USENIX Security 2022, the first quantitative comparison of synthetic data against traditional anonymisation. Their finding: synthetic data either fails to prevent inference attacks or fails to retain utility. It does not escape the privacy-utility tradeoff; it relocates it.
That paper's threat model is genuinely contested, and you should know the counter-argument before you cite it. Later work argues that attacks assuming the adversary knows the generator's architecture overstate real-world risk, because a defender can simply decline to publish it. The result below does not rest on that assumption: its attacker sees only the released synthetic table and a handful of quasi-identifiers anyone could look up.
Then it got more specific. Ganev and De Cristofaro's work on similarity-based privacy metrics attacked the exact metrics vendors publish in their quality reports. Their ReconSyn attack "reconstructs 78% to 100% of the underrepresented train data records (or outliers) with perfect precision in all settings" — while producing synthetic datasets the similarity metrics score as private. Distance to Closest Record is not a privacy guarantee. It is a plot of how far the generator wandered.
The most useful number for a buyer comes from a June 2026 systematisation-of-knowledge preprint by Golob, Pentyala and De Cock, whose attacks placed first among all red teams in the 2025 NIST Collaborative Research Cycle. They ran fourteen attacks against nine generation methods across five datasets. Their headline table reports mean reconstruction accuracy against a random-forest attacker — on the Adult dataset at 10,000 rows, where a random-guessing attacker scores 10.5%:
| Generation method | Reconstruction accuracy |
|---|---|
| Cell suppression (de-identification) | 52.3% |
| TabDDPM (diffusion) | 38.9% |
| TVAE | 24.1% |
| CTGAN | 21.2% |
| MST with DP at ε = 1 | 20.9% |
| MST with DP at ε = 0.1 | 13.1% |
Read the ordering, not just the magnitudes. Classical de-identification is the most exposed method in the set — which is the strongest argument for synthesis anyone has made — but a good non-private generative model lands in the same band as a differentially private one at ε = 1. The authors' summary is that "the generator, not the adversary, is the dominant lever on risk" — reconstruction accuracy "varies far more with the SDG method than with the attack" — and that "most reconstruction reflects distributional structure rather than memorization, concentrating individual risk on atypical records."
Atypical records are your problem. In a customer table, the atypical records are the private-bank clients, the executives, the one patient in the county with that diagnosis. Synthesis protects the median row extremely well and the rows you most need to protect considerably less well.
Differential Privacy Is the Only Real Guarantee, and the Defaults Are Too High
Differential privacy is a mathematical bound on how much any single training record can influence the output, expressed as an epsilon budget — and it is the only property in this market that a regulator can check rather than take on trust.
Two products in the table offer it and set it very differently.
NVIDIA's NeMo Safe Synthesizer applies DP-SGD across the whole fine-tuning run — a genuine model-level guarantee — and its tutorial gives a "Recommended starting range: ε ∈ [8, 12] — adjust downward based on privacy needs." Hold that against the NIST CRC result above. From ε = 1 to ε = 1000, reconstruction advantage against MST "barely stirs (20.9%→18.5%)"; the authors describe "a flat plateau" and conclude that "above ε=1 the binding constraint is thus MST's pairwise capacity, not its noise." The vendor's recommended starting point sits inside the plateau. That does not make Safe Synthesizer a bad product — it is the cleanest DP implementation you can buy with support attached — but ε = 10 buys you a defensible audit artifact, not much measurable protection. If you want the protection, you are looking at ε ≈ 1 or below, and NVIDIA's own docs tell you to "monitor SQS scores to understand quality impact" at that setting and warn that for datasets under 5,000 records "DP may significantly reduce quality."
Tonic Structural takes the opposite approach: a Differential Privacy toggle on the Categorical and Continuous generators, disabled by default, budgeted at "ε = 1, with δ = 1/(10n), where n is the number of rows." A far stricter epsilon — but the documentation places the budget at the generator level, and there is no single dataset-level epsilon in it. Under standard sequential composition, per-column budgets add up; turning the toggle on for twenty columns does not leave you at ε = 1 for the table. Ask Tonic for the dataset-level figure in writing before you cite one to your DPO.
Everything else in the table has no formal guarantee at all. Most instructive is Snowflake's GENERATE_SYNTHETIC_DATA, included in Enterprise Edition, which offers an optional built-in privacy filter that will "remove rows from the target table that are too similar to rows in the input table." That is precisely the class of metric ReconSyn defeated. If you already run Snowflake Cortex, you have a synthetic data generator you are paying for and probably not using — use it for utility work and load testing, and do not present its output as anonymised.
Tabular Fidelity Does Not Transfer to Text or Images
Every fidelity and privacy claim in this market is a claim about tabular data, and none of it carries over to free text or images. Buyers get this wrong constantly.
For tabular data, synthesis is mature. A March 2026 study in Advanced Science synthesised longitudinal records from nearly one million real patients with diabetes in the Andalusian Population Health Database and replicated clinical prediction performance on a chronic-kidney-disease onset task. That is a genuine result at genuine scale.
For free text, the mechanism is completely different. Nobody generates a synthetic clinical note by fitting a joint distribution; they detect entities and then redact or replace them. Tonic Textual "uses its built-in models to scan the files and identify sensitive values," which you then redact or replace with "a realistic replacement" — a detection problem, with detection's error profile. Published work on synthetic free-text medical records using masked language modelling reports 96% PHI recall and 3.5% re-identification risk. Ninety-six percent sounds excellent until you do the multiplication: across a million notes, 4% residual identifiers is tens of thousands of leaked values, and the misses are not random — they cluster on rare names and unusual constructions, which is the outlier problem again. Text de-identification is a per-corpus measurement exercise, not a purchase. Budget for a manual residual-PHI audit on a stratified sample, every time.
For images, "synthetic data" means simulation, not privacy — rendering pipelines like NVIDIA Omniverse Replicator produce training frames from 3D scenes, which is a data-scarcity answer, not a data-confidentiality one. If the underlying question is whether patient scans can leave the building, no image generator solves it.
The practical consequence: your document pipeline and your database pipeline need separate tools and separate evidence. That mirrors what we found comparing Textract, Azure Document Intelligence and LLM-based extraction — structured and unstructured paths do not share a vendor answer.
When Masking Is the Cheaper Answer
If the requirement is "developers need a realistic non-production database," masking almost always wins on cost, speed and explainability — and most synthetic data projects are really this requirement wearing a better job title.
Masking replaces sensitive values in real rows with plausible substitutes, deterministically, preserving referential integrity across tables. It is decades old, boring, and it does exactly one thing you can explain to an auditor in a sentence. Synthesis fits a generative model, which introduces training time, a fidelity report nobody outside the data team can interpret, and a privacy argument you now have to defend.
The cost gap is real and checkable. PostgreSQL Anonymizer shipped version 3.0 on 11 February 2026 and lets you declare masking rules in DDL, as security labels on the columns themselves — free, and the policy lives in version control next to the schema. Greenmask is Apache-2.0 and works as a drop-in replacement for pg_dump. On the commercial end, Oracle's Data Masking and Subsetting Pack lists at $11,500 per processor plus 22% annual support — expensive, but a published number, which is more than Tonic, Syntho, Delphix or K2view will give you without a sales call.
Choose masking when the consumer is a human developer or a deterministic test suite, when referential integrity across dozens of tables matters more than distributional fidelity, and when the data never leaves your network anyway.
Choose synthesis when the consumer is a model — training, evaluation, or bias testing — because a masked table's marginal distributions survive but its multivariate structure is mangled, and that is exactly what a model learns from. Also choose it when you need to share data across a boundary you cannot mask your way through: with a partner, a vendor, or a research group.
The tell that you have bought the wrong thing: your synthetic data project's stated success metric is "QA has representative data" rather than a measured downstream model score.
What Regulators Actually Accept as Anonymous
No major regulator treats synthetic data as automatically anonymous. Every one of them treats it as a technique whose output must be assessed case by case — which means the assessment, not the tool, is the deliverable.
A regulatory-perspective review published 28 November 2025 compared guidance from three jurisdictions and found the same conditional posture in all of them. The UK ICO requires you to evaluate "whether the personal information on which you model the synthetic data can be inferred from the synthetic data itself," and treats the output as non-personal only where residual risks are "very low." Singapore's PDPC states that "conditions apply for synthetic data to be treated as non-personal information" and that "privacy evaluation is consequently an essential part of good SDG practice." South Korea's PIPC lands in the same place. Singapore's regulator has published a full proposed guide on synthetic data generation as a PET — read it before your DPIA, not after.
In the EU, Article 10(5) of the AI Act is the provision that will actually shape your programme. It permits processing special categories of personal data for bias detection and correction in high-risk systems only where that purpose "cannot be effectively fulfilled by processing other data, including synthetic or anonymised data." Read that carefully: the AI Act makes synthetic data the default first attempt, and requires you to demonstrate its insufficiency before touching real sensitive attributes. Your synthetic data evaluation is therefore evidence in a compliance argument, whichever way the result goes. That fits the inventory-first posture we argued for in EU AI Act governance tooling.
In UK financial services, the FCA's Synthetic Data Expert Group published governance considerations on 19 August 2025 telling firms that "practitioners are encouraged to build on existing model risk management (MRM) and Data & AI Ethics structures" and that "synthetic data's impact on models ought to be validated methodically." In other words: the generator is a model, it goes in your model inventory, and it gets validated like one. Most firms discover this after buying the platform. It is the same trap as buying an MLOps platform for a regulated environment and finding the sign-off layer was never included.
Who Should Not Buy Each Option
This is the section vendors never write, so here it is.
Do not use the MOSTLY AI SDK if you need a supported vendor relationship, an SLA, or someone to call at 2am — the company is gone and the repository is community-maintained. Also skip it if your source data lives across forty tables in Oracle and DB2 and you need referential integrity managed for you; it is a library, not a platform.
Do not buy Tonic if your requirement is a formal privacy guarantee you will show a regulator. It is an excellent, self-hostable test-data platform with real database connectors, and customer data does not leave your VPC on a self-hosted deployment. But its DP is a per-generator toggle, not a dataset-level bound, and the enterprise tiers are contact-sales with no published rate card.
Do not buy NVIDIA NeMo Safe Synthesizer if you do not already run GPUs and an NVIDIA AI Enterprise entitlement. The licence is real money — Dell lists NVIDIA AI Enterprise at $18,000 per GPU for a five-year subscription — and there is no self-serve path since the Gretel console retired. Skip it too if your workload is a 3,000-row table; the docs warn DP significantly degrades quality below 5,000 records.
Do not buy Syntho without a change-of-control clause and an escrow conversation. It is a credible on-prem European vendor with feature-based, non-consumption pricing — a genuine advantage over usage meters — but it just absorbed a competitor's brand after that competitor's collapse. Its marketing describes a built-in differential privacy mechanism, but it publishes no epsilon budget — ask for one.
Do not standardise on SDV for anything you sell or expose outside your own organisation; the Business Source Licence forbids running it as a synthetic data service, and "outside your organisation" is doing real work in that sentence for anyone with a joint venture or an outsourced dev team.
Do not present Snowflake's built-in generator as anonymisation. It has no documented formal guarantee, its similarity filter is exactly the metric class the research defeated, and it will fail outright on NULL values in non-string columns when that filter is on.
Do not buy any of them if what you needed was masking. Which is most of you.
The Four Questions That Predict Regret
Ask these before the demo, not after.
- Who consumes the output — a model or a person? A model needs multivariate fidelity and you need synthesis. A person needs a database that looks real and you need masking. Answering this wrong is the single most expensive mistake in this category.
- What epsilon will you actually ship at, and is it per-dataset or per-column? Get it in writing. If the vendor answers with a similarity score or a "privacy score out of 100" instead of an epsilon, you have your answer about what they are selling.
- Who owns your outliers? Ask the vendor to run their own privacy evaluation on the rarest 1% of your rows, not the aggregate. Every published attack concentrates on atypical records; every vendor quality report averages them away.
- What happens when the vendor is acquired? Three of four already changed hands — Gretel by acquisition, Hazy by asset sale, MOSTLY AI by liquidation. Require source escrow, a data-export format that is not proprietary, and a change-of-control clause with a real termination right — the same posture that should now be standard in every AI contract, as we argued when zero data retention turned out not to be zero.
What to Do in the Next 90 Days
This Week: Pick one real table and one real downstream metric — a model AUC, a query result set, a test suite pass rate. Install the MOSTLY AI SDK in LOCAL mode inside your perimeter and generate against it. You are not evaluating vendors yet; you are finding out whether synthesis preserves your signal at all. If it does not, you have found that out for free.
This Month: Run the honest alternative in parallel. Stand up PostgreSQL Anonymizer or Greenmask against the same table and give both outputs to the same consumer. If masking clears the bar, close the procurement and spend the budget elsewhere. If it does not, you now have a documented reason to buy, which is the thing your finance partner will ask for.
Before Quarter Close: Write the privacy evaluation before you write the RFP. Define your epsilon target, define your outlier test set, and define who signs off — because under the FCA's guidance and the EU AI Act your generator is a model in scope, and that assessment is the deliverable regardless of which vendor you pick. Add the generator to your model inventory the day it goes into a pipeline, not the day an auditor asks.
Before You Sign: Get the dataset-level epsilon, the change-of-control terms and the export format in the contract. All three are negotiable before signature and none are afterwards.
The Bottom Line
Synthetic data has quietly followed the arc that hit test data management, then observability, then evals: a wave of specialist vendors, a genuine technical advance, a consolidation that leaves the technology in the hands of platform companies, and a set of buyers holding contracts with entities that no longer exist. What is different here is that the specialists were selling a guarantee, and the guarantee was always weaker than the pitch. The research community said so in 2022, refined it in 2023, and quantified it against a NIST benchmark in 2026, while the marketing kept saying "privacy-safe."
The good news is that the useful part is free, permissively licensed, and runs on your laptop. Start there. Buy a platform when you have a measured reason, an epsilon you chose yourself, and a contract that survives the vendor.
The best synthetic data platform is the one you never had to buy because masking was enough.
Continue Reading
- Best RAG Platforms for Regulated Industries: Permissions First
- Best MLOps for Regulated AI: Domino, Then a Sign-Off Layer
- Hospitals Test Vendor AI. Fewer Than Half Have a Sandbox.
- EU AI Act Governance Tools: Buy Inventory, Not Policy Packs
- OpenAI Privacy Filter: The Free PII Detection Model That Runs On Your Laptop
- Textract vs Azure vs Gemini: Split OCR From Extraction
- Vector Database Pricing: Only pgvector Publishes a Rate
- Oakley Bought Graphwise. GraphDB Isn't Open Source.