CloudMask is an endpoint data protection tool designed for SaaS applications. It encrypts (masks) user data so that only explicitly trusted contacts can view it in its original form; all other parties — including the SaaS provider, system administrators, gateways, and CloudMask itself — see only unintelligible data. Data is protected using secret keys that reside exclusively on the end user's device and are never transmitted over the network. This means that even in the event of a breach of the underlying SaaS application, a national security letter, or a breach of CloudMask itself, the customer's data remains protected. The product is delivered as a browser extension (supporting Chrome and Firefox) and operates with a single-click mechanism: users click a lock icon to mask data before submission. CloudMask automatically detects intended recipients and unmasks data only for those trusted contacts. CloudMask targets professionals in regulated industries such as legal, financial, healthcare, and education, where protection of Personally Identifiable Information (PII) is critical. It also offers an SDK/integration path for SaaS developers to embed endpoint data protection into their own products. CloudMask has achieved Common Criteria certification, recognized by 26 cybersecurity agencies worldwide. A free 30-day trial is available with no credit card required.