I'm working at a company with a lot of sensitive data, and they want to irreversibly mask or scramble certain field values when they go into a Sandbox refresh, so that even Admins in Sandbox cannot tell what those values were. I haven't found a way to do this during the refresh, yet, so I'm leaning toward a massive update using MapReduce script(s). Do any of you know a way to catch the data BEFORE it gets to the Sandbox, when it's being refreshed?

not really catching, but you can encrypt the data in production and only decrypt the data in production when the record is viewed using suitescript

to my knowledge you can't interpose in the refresh data in any way "before" activating it. if you just update the data in place post refresh, all the original values are in system notes for the respective records. the only way i've done this 'completely' is with a 2 step refresh using 2 separate sandboxes. refresh prod to sandbox 1. run your obfuscation processes. then initiate a refresh from sandbox 1 to sandbox 2. this loses the system notes that store the 'old' values. Anyone in sandbox 2 (but not in 1 or prod) won't be able to see the original info.

Thank you for your ideas, @battk and @shea brennan. I might be able to do this without an extra sandbox, and clear the sensitive data from system notes using the piremoval suitescript module, since the docs for it say it can overwrite system notes.