Platform · Privacy

Privacy.trustData Privacy & Access Governance

You can't protect what you haven't found. Protect discovers sensitive data across all your systems, labels it, and then enforces the handling rules for access, masking, and retention everywhere the labels travel.

The product, at a glance

What Privacy is made of.

6 capabilities, and the part of the mechanism this product carries. Every box opens right here, with its full story one tap deeper.

tap any box, or any circle in the mechanism, and it answers right herecontrol what changes

What changes

What changes when this is running.

Not promises of speed, but mechanisms: each of these happens because of how the product works, not because we say so.

Copies stop escaping policy, because sensitivity labels travel down lineage to every derived table, report, and extract.

Access reviews stop being archaeology, because every grant carries its reason on the record and expires on schedule.

Data leaves the source already safe, because masking happens inside the connector before anything moves.

who lives herePrivacySecurity

The product

Discover. Classify. Protect. Govern. Prove compliance.

End-to-end privacy governance across the full data lifecycle. Know what personal data you hold, where it lives, how it is used and who can reach it, while honouring individual rights and proving it.

Trust and Scale

Business outcomes

Stronger customer trust

Regulatory compliance and readiness

Lower risk of fines and breaches

Faster response to data subject requests

Reduced cost of compliance

Data minimisation by design

Continuous privacy assurance

At a glance

Know what personal data you have, where it resides, how it is used and who can access it, while enabling data subject rights and proving compliance.

Discover

Find personal and sensitive data across systems, apps and clouds.

Classify

AI-powered classification, with a confidence score and human review.

Govern

Manage consent, purpose, policies, retention and lawful basis.

Protect

Enforce privacy controls, masking, DLP, encryption and access restrictions.

Respond

Automate subject requests and breach response, with workflow and audit trail.

Prove

Maintain immutable evidence and demonstrate compliance.

Trigger events

When an institution reaches for this.

A subject access request with no way to find the person across the estatePersonal data discovered in a system nobody knew held anyConsent recorded in one place and ignored in anotherRetention policy written down and enforced nowhereA breach notification clock running while the scope is still unknown

What it does

Seven stages from finding personal data you did not know you held to proving what you did about it.

01 · Discover and inventoryScan and catalogue personal data across structured, unstructured and semi-structured sources.

Data source connectors
Deep content discovery
Unstructured scanning: documents, email, PDFs, images
Shadow data discovery

Hover, click or use the arrow keys to walk the lifecycle.

Where privacy is actually enforced

Privacy is not a policy document, it is six enforcement points along the life of the data. A rule that exists at storage and not at sharing is not a control, and the reason this is drawn as a run rather than a list is that a gap at any one point undoes the five around it.

01 · IngestionNothing enters unclassified

Data source connectors
Deep content discovery
Unstructured scanning
Shadow data discovery
Classification at capture

Where the data starts, and the only layer nobody governs.

Every point writes its own evidence, which is what lets an accountability question be answered from the record rather than from memory.

One subject request, end to end

The data subject rights workflow, from a request arriving to the evidence being retained. The colour says who does the work at each link, and the two human links are the ones a regulator will ask about.

01 · Request receivedAutomated

Through the portal, by email or by API, and the clock starts here.

A chain is a conjunction. Take one link out and see what is left.

Automated
AI-assisted
Human approval

The clock on a subject request starts when it arrives, not when someone notices it. Every link here leaves the artefact the next one needs, which is what makes the deadline survivable.

One customer's data, followed across the estate

Personal data does not sit in one place, it travels, and the lawful basis travels with it. This is one worked flow with the basis, the purpose, the retention and the risk named at every hop.

01 · Customer onboardingContract

Purpose: onboarding. Retained seven years. High risk.

A chain is a conjunction. Take one link out and see what is left.

Verified and active
Inferred, awaiting review
Planned, not in use

An illustrative flow for ABC Bank, the site's standing fictional institution. The point is the shape: the lawful basis changes three times across seven hops, and each change is a decision somebody has to be able to defend.

Key capabilities

Data discovery and inventory

Data source connectors
Deep content discovery: PII, SPI, financial PII, PHI
Unstructured data scanning: documents, email, PDFs, images
Shadow data discovery
Data inventory and catalog
Data lineage integration
Risk-based discovery

Classification and risk

AI classification engine
Sensitive data taxonomy: PII, SPI, special categories
Contextual classification with a confidence score
Human review and validation
Risk scoring and prioritisation
Reclassification and tuning
Classification policies

Privacy governance

Lawful basis management
Consent and preference management
Purpose management
Data minimisation rules
Retention and disposition
Privacy policies and standards
Privacy impact assessments: PIA and DPIA

Access and use control

Role and attribute based access
Purpose-based access control
Dynamic data masking
Tokenisation and pseudonymisation
Re-encryption management
DLP and data exfiltration controls
Just-in-time access

Data subject rights

Request intake: web, portal, API
Identity verification
Request orchestration
Search across systems
Response generation
Workflow and approvals
Audit and communication log

Monitoring and assurance

Privacy activity monitoring
Access and usage analytics
Policy violation alerts
Third-party risk monitoring
Breach detection and alerts
Continuous control testing
Privacy score and KPIs

Evidence and reporting

Regulatory reporting packs
Audit evidence repository, immutable
Consent and preference audit
Subject request and breach reporting
Attestations and certifications
Dashboards and trends
Export for regulators and audit

Where the platform proposes

AI-powered, and every one of them a recommendation rather than a decision.

Classify personal and sensitive data at scale, with a confidence score

Find data in unstructured content: documents, email, PDFs, images

Surface shadow data in systems nobody inventoried

Locate one data subject across every system for a request

Score and rank privacy risk by likelihood and impact

Detect policy violations and exfiltration as they happen

Manual and AI-assisted

The same work, split. Everything on the left is something a person does; everything on the right is something the platform proposes, with evidence, for a person to accept. Nothing crosses the line on its own.

Manual

A person does this.

Set the lawful basis and the purpose for each use
Decide retention and the disposition schedule
Review and validate a classification
Apply the exemptions on a subject request
Approve what is delivered to a data subject
Decide whether a breach is reportable

AI-assisted

The platform proposes. A person accepts.

Discover personal data across systems, apps and clouds
Classify it, with a confidence score attached
Scan unstructured content and shadow data
Locate one subject across the estate
Score privacy risk and rank remediation
Detect violations, exfiltration and anomalous access

Regulatory coverage

Europe

GDPR
UK GDPR

Americas

CCPA and CPRA, California
PIPEDA, Canada
LGPD, Brazil

Asia Pacific

APPI, Japan
PDPA, Singapore

And beyond

Multi-jurisdictional frameworks
Sectoral regulations

Common use cases

Where institutions start

GDPR and UK GDPR compliance
CCPA and CPRA consumer rights
PIPEDA compliance in Canada
Financial personal data protection and masking
Consent management and a preference centre
Data minimisation and retention enforcement
Subject request automation and orchestration
Third-party data risk management
Breach response and regulatory reporting
Privacy impact assessments: DPIA and PIA

End-to-end workflow

01Discovery
02Classification
03Context and purpose
04Policy and consent
05Control enforcement
06Subject request
07Incident response
08Evidence and reporting

What gets measured

Against your own baseline.

Privacy programme scorePersonal data inventory coverageCritical privacy controls effectiveSubject requests handledAverage subject request response timeConsent record accuracyOpen privacy policy violationsReportable breaches

Who it is for

Chief privacy officerPrivacy office and counselData owners and stewardsInformation securityBusiness units and product teamsRisk and complianceInternal audit

Integrations

OntaVera CatalogOntaVera GovernanceOntaVera LineageOntaVera QualityOntaVera RegulatoryOntaVera Reference DataOntaVera Trust IntelligenceIdentity providers and IAMDatabricks, SnowflakeCloud storage: AWS, Azure, GCPCollaboration and emailServiceNow, Jira

Built on the OntaVera platform

Shared by every product in the suite.

Financial ontology and knowledge graph

Metadata fabric and connectors

Policy and rules engine

Workflow and approvals

AI and ML services for discovery and classification

Audit and evidence, immutable

Security and identity: separation of duties, RBAC, ABAC

Why OntaVera

AI-powered discovery and classification at scale
Unified privacy governance across the whole data lifecycle
Built-in regulatory mappings and ready-to-use controls
Subject request automation with audit-ready evidence
Privacy by design, with strong security integrations

Protect data.Respect rights.Prove compliance.Earn trust.

Try it yourself

See Privacy do real work.

setting the stage…

Inside Privacy6 sub-modules

You cannot protect data you have not found, and mapping where customer information actually sits across hundreds of systems is hard, careful work. Discovery scans your systems for sensitive data with detection tuned for recall, so any misses land on the false-positive side where a human can trim them. Every finding shows the evidence behind it, and nothing becomes a policy-bearing label until a steward signs off.

What you get

Recall-first detection runs across native connectors for the systems a first report needs, with OpenLineage ingest and an SDK for the rest with no per-connector fees. The scan reads metadata in place and copies nothing out.

Every candidate finding carries its evidence: the pattern that fired, the column profile, and the context that triggered it.

Findings land as claims, never as truth. A steward confirms each one under maker-checker before it carries policy weight.

Coverage is something you can defend: any system that has not been scanned shows as an explicit gap, because absence counts as failure.

Confirmed classifications join the governed knowledge graph, tied to the CDEs and lineage they affect.

Every scan and every decision is sealed on the hash-chained ledger, so you can show an examiner what you knew and when.

How it works

Scan

Connectors profile your systems in place, reading metadata only and copying nothing out.

Detect

Recall-first classifiers flag candidates and attach the evidence that fired.

Confirm

A steward accepts or rejects each finding through one decision door. Agents propose, and humans decide.

Seal

Confirmed classifications are sealed on the ledger and flow straight into labels and policy.

Questions buyers ask

Asked about Privacy

5 questions

Most classification tools stop at the source table, and the risk lives in the copies. Here, a steward-confirmed label travels down lineage to every derived table, report, and extract, and the same label drives access, masking, and retention. That gives you one classification to defend instead of several tools to reconcile.

How labels travel with lineage →

No. The platform holds metadata only, under your keys, and discovery reads your systems in place without copying anything out. Masking and tokenization happen inside the connector before anything moves, keys stay yours through bring-your-own-key, and air-gapped deployment is supported.

Security and deployment →

Stewards confirm or reject classification findings through one decision door, with the evidence attached so each call is quick to make. Your policy owners set the access rules, purposes, and retention schedules, while grants expire on their own and evidence packs assemble themselves from the ledger. The recurring burden shifts from chasing entitlements and building audit binders to making decisions that arrive already teed up.

Agents do the finding: they scan for sensitive data, propose classifications, and attach the evidence behind every candidate. They cannot make anything true on their own. No label carries policy weight until a steward confirms it under maker-checker, labels are derived rather than set by hand, and nothing an agent produces can grant access or close an issue by assertion.

Agents propose, stewards decide →

It fails closed. If a policy cannot be evaluated, access is denied; if a connector cannot confirm a masking rule applied, the data does not move; if an expected masking hop goes missing, an issue opens and closes only when evidence verifies the fix. Systems that have not been scanned show as explicit gaps, so absence reads as failure rather than as silence.

Fail-closed masking in detail →

Stronger together

One shared record, so products compound.

Every product you add makes this one smarter, because they read and write the same governed record. Start where it hurts most; nothing you adopt later starts from zero.

Privacy + Lineage

Add lineage and a sensitivity label set once at the source governs every downstream copy automatically.

Privacy + Catalog

Add the catalog and classified data shows its labels, owner, and handling rules wherever anyone finds it.

Getting started

Start small, and prove it on your own systems.

Most banks start with one priority report and five source systems, live in 90 days, then bring in more of the platform behind exit gates they approve. Privacy is part of that first conversation.

Keep exploring

← Qualityavailable now Regulatory →available now The engines underneatharchitecture How decisions workframework

The next step

Start with proof, not a promise.

There are three ways in, and each one earns the next. You approve the exit criteria before we spend any more of your time or budget.

A 60-minute working session

Bring one report that is expensive to prove. We walk the mechanism against it. Nothing is required from your side.

A two-week guided sandbox

Your team works hands-on against a synthetic sample bank. It requires zero access to your systems and zero procurement.

A six-week proof on your systems

We use read-only metadata across five systems and one priority report, scored against criteria both sides sign first. The decision it produces is yours.

Book a working session See the adoption path