1. A method comprising: storing, in a database maintained on one or more storage devices, a plurality of cryptographically transformed values; receiving a request to access data from the database; determining, from the plurality of cryptographically transformed values, a cryptographically transformed result of the request; determining a data characteristic for masking the cryptographically transformed result; without decrypting the cryptographically transformed result, generating, from at least part of the cryptographically transformed result, a masked result that conforms to the data characteristic; wherein the method is performed by one or more special-purpose computing devices.