Data security governance, in plain language.
The data-layer side of data security — how sensitive every column is, who can read it, and who is accountable — for teams without a security department.
crm.customers · masking check
Sample data| Column | Level | Sample value |
|---|---|---|
| customer_id | Internal | 48213 |
| Confidential | anna@example.com*****@***** | |
| iban | Restricted | DE89 3704 0044…**** **** **** |
| phone | Confidential | *** *** **** |
We find the gap and name the owner. The masking policy itself is set in Snowflake by your team.
Data security rests on four ideas
Here is what AB Data Management covers for each — honestly, including where we stop.
Authentication
Who are you?Only for our own app: email and password, with optional single sign-on. We don't manage your Snowflake users.
Out of scope for your dataAuthorization
What may you do?Shows which Snowflake roles and users can read each sensitive table, including through databases, schemas and shares.
Covered for Snowflake (visibility)Access
What can you reach — and should you?Flags access that looks too broad, access open to everyone, direct grants to one person, and sensitive columns with no masking policy.
Partly — we find the gaps, you fix themAudit
Can you prove it?Records owner decisions with reasons and expiry dates, runs recertification, and exports a posture summary. Doesn't read query logs.
PartlyFrom the book to your warehouse
The data security areas small teams struggle with most, and what we do about each one today.
| Area | The problem | What AB Data Management does | Coverage |
|---|---|---|---|
| Classify confidentiality | Nobody knows what needs protecting | Four levels suggested for every column; your decision wins | Covered |
| Regulatory categories | Privacy and confidentiality get mixed up | Tags such as PII, PCI, PHI and Regulated, plus your own | Covered |
| Least privilege | Access piles up and nobody prunes it | Limits per level; flags for access open to everyone and direct user grants | Partly |
| Masking | Sensitive columns readable in clear text | Finds sensitive columns with no masking policy; Unknown when it can't check | Partly — finds, doesn't fix |
| Clear accountability | Nobody owns the risk | Owners by business domain; each owner sees their own risks | Covered |
| Policy exceptions | Risks accepted verbally, never revisited | Reason and expiry required; the risk comes back on its own | Covered |
| Audit and evidence | Can't show who decided what | Owner decisions recorded; posture summary export | Partly |
| Monitoring access behaviour | Unusual queries go unnoticed | — | Not covered |
| Network, devices, malware | External attack | — (not our job) | Not covered |
Built around concepts from DAMA-DMBOK. Not affiliated with or endorsed by DAMA International.
See your own coverage, not ours
Founding customers get a free report on which of their Snowflake data is sensitive, who can read it, and what looks too broad.