Is there ability to mask any data sent to customer from chat bot?

Yes, you will need to capture the information in BotKit. Mask it and then send to any report etc.

The developer could mask or redact the sensitive information provided by end users by enabling the PII (Personally Identifiable information ) settings.

The settings allow the developer to define a regular expression after which if the user input matches the pattern, the data is redacted and stored on the platform.

Please refer to the below topics and links for more details.

https://developer.kore.ai/docs/bots/bot-builder/editing-an-existing-bot/pii-data-masking/

*Note:*Masking can even be achieved by using the custom entity type and script nodes. Regex can be defined and if user input matches the pattern the inputs are masked and stored into other context variables for displaying at different bot responses.