DataTugPull more from your data
Open app
☰

For your role · Security, compliance and auditors

For security: who can read which data

Engineers, support staff, contractors and now AI agents all read production. DataTug Perimeter is designed to apply one set of rules to all of them. Local access policies work today; Perimeter is in development; masking, approvals and the audit trail are planned.

Explore the demo project All roles
Watercolor of a harbour master’s desk with two open ledgers, a gate log with tick marks and a plain brass stamp, a gate bar and a tugboat beyond the window.

I need to know who can reach which data, and prove it. Today the answer is a shared login and a spreadsheet.

Your day

  • Shared logins. Several people and tools use one database account, so access reviews end at the account.
  • Two systems of rules. Roles and a VPN for people, a separate gateway or replica for agents, and the rules drift apart.
  • Sensitive fields everywhere. Anyone who can connect sees the emails and phone numbers, or the data is scrubbed by hand.
  • Proof after the fact. When a review asks who read what, the evidence is a set of database logs nobody joined.

One task, before and after: limit who can read customer contact details, and be able to show it

Who: Security, compliance and auditors

Today

4 tools1 hand-off1 shared password

  1. You · SpreadsheetSeveral people and tools share one database login; list the accounts and guess who used each.a password changes hands
  2. Each team · ChatAsk teams which tools and agents connect, and how.
  3. You · Database logsExport database logs and try to join them.
  4. You · Report documentWrite up an answer you are not sure of.
Today4 tools · 1 hand-off · 1 shared passwordSeveral people and tools share one database login; list the accounts and guess who used each.Ask teams which tools and agents connect, and how.Export database logs and try to join them.Click to see

With DataTug

1 workspace0 hand-offsno shared password

Some steps are planned or in development.

  1. Policy ownerLimit sources, tables and fields with access policies today.Access policiesAvailable
  2. People and agentsPut people and agents behind one Perimeter with the same rules (in development).DataTug PerimeterIn development
  3. The serverMask sensitive fields on the server for everyone who reads them (planned).Meaning-driven masking on the serverPlanned
  4. YouList who can read a table, people and agents (planned).Audit trail merged with provenancePlanned
  5. YouRead one audit trail of reads, requests and approvals (planned).Audit trail merged with provenancePlanned
With DataTug1 workspace · 0 hand-offs · no shared passwordLimit sources, tables and fields with access policies today.Put people and agents behind one Perimeter with the same rules (in development).Mask sensitive fields on the server for everyone who reads them (planned).Click to see

Each step names the part of DataTug it relies on and that part’s status today. “Planned” and “In development” steps describe where the product is going, not what you can use now.

Today’s access policies are enforced by your local DataTug CLI: an agent that can read your machine’s DataTug configuration could get past them. Server-enforced access through one Perimeter is in development. How access policies work

Solutions for you

Also useful: Incident InvestigationData Quality & Monitoring

Try it on sample data

The public demo project opens in the browser with sample Northwind and Chinook data. No sign-up.

Explore the demo project