Trace Sensitive Data Across Connected Enterprise Systems

Follow Business Data, Not Just Technical Tables

Most lineage tools describe technical plumbing — tables, columns and pipeline jobs. That is useful for data engineering, but it does not answer the question a privacy, testing or audit team actually has: where does a specific piece of sensitive business information live, and where does it go from there? DataVault organizes lineage around the sensitive business concept itself — such as an employee's personal email — and follows that concept as it takes different shapes across different applications.

A single concept like Personal Email can appear as Worker.personal_email in an HCM system, Contact.Email in a CRM, and email_address in a reporting data set. DataVault maps that business concept across the system-specific objects and fields where it is configured to be tracked, rather than requiring teams to manually cross-reference field names system by system.

Overlay Masking Status on Data Lineage

Lineage on its own tells you where data goes. Combined with Masking Policy and verification results, it tells you whether that data is protected once it gets there. This overlay is a core part of what makes DataVault's lineage privacy-aware rather than purely technical: every node and every path between systems can carry a protection status.

This is the difference DataVault is designed to surface: it is not enough to know that National ID data reaches four systems — it matters whether each of those systems is still protected, still verified, or has quietly drifted out of compliance since the last check.

Build Lineage From Connected Metadata and Mappings

DataVault does not claim to discover every data flow in an enterprise automatically. Instead, where connectivity is configured, it can combine connector metadata and configured mappings to build a business-aware lineage model. Possible inputs to that model include, where supported:

DataVault can combine connector metadata and configured mappings to build a business-aware lineage model. The resulting model is only as complete as the connectors and mappings that have been configured for a given environment — it is not a fully automatic discovery process, and gaps should be expected where connectivity has not yet been established.

Understand the Impact of a Protection Policy Change

Because lineage connects a Masking Policy to every place its underlying data concept is used, it can also support impact analysis before a policy is changed. For example:

For governance and change-management purposes, this kind of view is designed to help a team see the downstream footprint of a policy change before rolling it out, rather than discovering the affected systems after the change has already shipped.

Use Lineage to Design End-to-End Tests

A sensitive attribute rarely stays inside one application, and neither should the test that covers a change to it. Data lineage can help identify which systems ought to participate in an end-to-end test scenario by showing every connected system a given data concept actually reaches.

Where the relevant connectors and automation exist, SyntraFlow can use this lineage context to help design or execute cross-system test coverage that follows the same path as the sensitive data itself, combined with representative records provisioned through Test Data Management. This is intended to support and inform test scope decisions — it does not generate a complete end-to-end test automatically without configured connectors and automation in place.

Lineage Alongside Masking Verification

Lineage tells a team where a status came from. The record-level detail behind a Verified or Drift Detected label typically comes from a Masking Verification pass against a connected object, such as the example below, which shows original values alongside masked values for individual records in a related capability, Data Masking.

Frequently Asked Questions