Sensitivity labels
A label that stays on the source table protects nothing, because the copies are where the risk lives. Here, sensitivity labels travel along lineage, so every derived table, report, and extract inherits the classification of its sources. When a transformation genuinely de-identifies the data, that anonymizing hop is recorded and the label steps down at that point, with proof.
Labels propagate down lineage automatically. They are derived, never set, so a downstream copy cannot be relabeled as public by hand.
Anonymizing hops are recorded on the graph: where masking, tokenization, or aggregation strips identity, the label steps down and the evidence for it is attached.
There is no manual override. A derived label follows from its sources and the recorded hops, and that is the only way it changes.
One classification drives every control: access, masking, and retention all read the same label off the graph.
When lineage changes, such as a new feed or a new join, labels re-derive, and any step up in sensitivity surfaces as an issue rather than passing quietly.
Every label decision is sealed on the hash-chained ledger with who approved it and why.
Source
Confirmed classifications from discovery set the label at the origin.
Propagate
The label flows down lineage on the governed graph, and every downstream asset inherits it.
Step down
A recorded anonymizing hop lets the label drop where identity is genuinely removed, with the evidence attached.
Enforce
Access, masking, and retention read the label directly, so there is nothing separate to keep in sync.
“Is this report safe to share outside the bank?”
The report carries a label derived from its sources along lineage, so its classification reflects everything upstream of it. If the label has stepped down through recorded anonymizing hops, the evidence for each step is attached, and you can share with confidence in what the label says.
“This extract was built from customer data, so why is it labeled internal?”
A recorded anonymizing hop, such as masking, tokenization, or aggregation, genuinely removed identity on the path to that extract, and the label stepped down at that point with proof attached. A derived label changes only through its sources and recorded hops, so the classification reflects what actually happened to the data.
“Can you prove the anonymized dataset is actually anonymized?”
Yes. The anonymizing hop is recorded on the lineage graph with its supporting evidence, and the label step-down is sealed on the hash-chained ledger with who approved it and why.
Start with proof, not a promise.
There are three ways in, and each one earns the next. You approve the exit criteria before we spend any more of your time or budget.
A 60-minute working session
Bring one report that is expensive to prove. We walk the mechanism against it. Nothing is required from your side.
A two-week guided sandbox
Your team works hands-on against a synthetic sample bank. It requires zero access to your systems and zero procurement.
A six-week proof on your systems
We use read-only metadata across five systems and one priority report, scored against criteria both sides sign first. The decision it produces is yours.