Turn the lights on in your data.
Know which of your Snowflake data is sensitive, who can read it, and whether that access looks too broad — with a named owner for every risk. More than a data catalog. Reads metadata only.
Built around the data security practices in DAMA-DMBOK.
Most teams run their data in the dark
You have data, and you have opinions about it. What you don't have is a map.
"We have customer data… somewhere."
Every column has a security level — and the sensitive ones are on one screen.
"Only a few people can see payroll."
6 roles and 1 named user can read payroll. Your policy allows 3.
"Finance owns that, I think." "Masking is set up, mostly."
Every sensitive table has an owner, a level and a next step — ranked by risk.
"We're too small for anyone to ask."
Customers, auditors and regulators already ask. Now you can answer.
"No one said it was a problem."
Anna accepted this risk on 2 March. It comes back to her on 2 June.
Sample data
From the dark to a plan, in four steps
You have data and assumptions
Tables in Snowflake, opinions in people's heads, a spreadsheet nobody trusts.
Every column gets a level
Public, Internal, Confidential or Restricted — suggested for you, decided by you.
You see who can read it
Roles and users with access to each sensitive table, and what looks too broad.
Owners decide, risks get dates
Sign off, accept with a reason and an expiry, or delegate. A plan you can show.
Define. See. Act.
The data-layer side of data security, for teams without a security department.
Every column gets a security level
AB Data Management suggests a level for every column from its name, description and neighbouring columns. Your team reviews it — and your decision always wins.
- Four levels: Public, Internal, Confidential, Restricted.
- Spots combinations that can identify a person, not just columns called "email".
- Tags such as PII, PCI, PHI and Regulated, plus your own.
- Lowering a level needs a written reason.
Try a column name
Live demoAlso in this table
Same name-pattern rules as the product. Suggestions only — your decision always wins. Nothing you type leaves this page.
Who can read it — and whether that looks too broad
We read your Snowflake grants and show every role and user that can reach each sensitive table — directly, or through its database, schema or a shared database.
- A flag when more roles can read it than your policy allows (by default 3 for Restricted, 10 for Confidential).
- A flag when it's open to everyone, or granted to one person directly.
- Sensitive columns with no masking policy. If we can't check, we say Unknown.
- You make the change in Snowflake. We show you where.
Who can read payroll.salaries?
An owner and a date on every risk
Each owner sees only what they own, what's risky, and what to do — no Snowflake access needed.
- Sign off, accept a risk (reason and expiry required), or delegate it.
- When an accepted risk expires, it comes back on its own.
- Recertification campaigns ask owners to re-confirm.
- Owner decisions are recorded. Export your posture summary as CSV or HTML.
payroll.salaries · accepted risk
Sample data"HR roles are being migrated — access will be trimmed by June."
The exception ran out, so the risk is open again and Anna is asked to decide.
A catalog tells you what you have. We tell you what's exposed.
Drag the handle to compare the same table.
payroll.salaries
Monthly salary per employee. Loaded nightly from the HR system.
payroll.salaries
Monthly salary per employee. Loaded nightly from the HR system.
Unknown, never a false all clear
Unknown means unknown
If we can't verify masking or access, we say so. We never mark something protected without evidence.
Metadata only
We read names, descriptions, grants and policy names — never the rows in your tables. Refreshed every time you sync.
You stay in control
We don't change anything in Snowflake. We show you where the gaps are and who owns them; your team makes the fix.
What it does not do
You might be thinking…
"Isn't this just another data catalog?"
The catalog is the foundation, not the point. What you get is a security view: where sensitive data is, what's unmasked, who can read it, and who owns each risk.
"Snowflake already has roles and masking policies."
Snowflake gives you the controls. It doesn't tell you which sensitive columns are missing them, or which tables more roles can read than they should. We show those gaps in plain language.
"We're too small for this."
Small teams get the same questions from customers, auditors and regulators as big ones — just without a security department to answer them. That's exactly who this is for.
"How do I know the findings are right?"
Every risk comes with a plain-language reason, levels are suggestions your team confirms, and anything we can't verify is marked Unknown.
The first 5 customers get 3 months free, a personal setup, and priority on the features they ask for.
Claim a founding spotReady to see your data in the light?
We'll connect read-only to your Snowflake and show you which data is sensitive, who can read it, and what looks too broad.