Skip to content

Get Started with eXate

eXate is a data sovereignty and DataSecOps platform: it embeds privacy-enhancing techniques (PETs) directly into the systems that store, move, or expose your data, so protection and jurisdiction-aware control travel with the data itself rather than living in a separate tool. This page gives you the shortest path to your first working setup.

If you're new here, work through the four steps below in order. Each step links to the detailed guide for that stage.

1. Pick the right product for where your data lives

eXate ships as several products, each protecting data at a different point in your stack. Start here rather than the product list, since the names alone don't tell you which one you need.

Where is the data when it needs protecting? Product Learn more
In transit through an API or gateway APIgator Overview
Queried live from a database (JDBC) Datagator Overview
Moved in bulk between systems (ETL) GatorSet Overview
Generated automatically from source schemas GatorAId Overview

Most deployments use more than one of these together, for example APIgator at the gateway layer and Datagator on the underlying database, both governed by the same rules and PETs.

2. Understand the core concepts

Every eXate product is built on the same underlying object model, defined once in the Platform documentation. You'll see these terms throughout the product guides, so it's worth knowing them before you configure anything:

  • Manifest (also called an Entitlement): the top-level object that maps your data schema, whether JSON, XML, or database columns, to eXate's protection model.
  • Attribute: a reusable label for one type of sensitive data, for example Email, CreditCard, or Salary. Classify a field once, and every place that Attribute appears inherits the same default protection. Related Attributes can be bundled into an Attribute Group (e.g. "Financial Data") so a Policy can protect the whole category at once.
  • Policy: defines which Attributes or Attribute Groups need protecting, who's allowed to see them unprotected (by Country and Claims), and why (Purpose of Use). If a request doesn't match, eXate falls back to the Attribute's default protection.
  • Filter: a dynamic, fine-grained restriction that can redact, mask, or transform data when specific conditions are met.
  • PET (Privacy Enhancing Technology) and PET Group: the actual protection mechanisms, cryptographic (encryption, tokenization) or non-cryptographic (masking), grouped into reusable configurations and applied to attributes by default or overridden per-field.

See the full object hierarchy and flow diagram for how these pieces connect, or the Vault and Admin pages for the configuration and tenancy management underneath all of the above.

3. Deploy and configure

flowchart LR
    classDef step fill:#eaf3fa,stroke:#01328e,stroke-width:2px,color:#01328e,font-weight:bold;
    classDef highlight fill:#add8e6,stroke:#01328e,stroke-width:2px,color:#01328e,font-weight:bold;

    A["Deploy product<br/>as sidecar or driver"]:::step --> B["Classify fields<br/>as Attributes"]:::step
    B --> C["Define your data schema<br/>as a Manifest"]:::step
    C --> D["Assign Policies and PETs<br/>to control access & protection"]:::highlight
    D --> E["Test via API<br/>or your application"]:::step
    E --> F["Monitor usage<br/>via Metering"]:::step
  1. Deploy: install the relevant product, for example as a sidecar alongside your API gateway (Apigee, Envoy, IBM API Connect, NGINX) or as a JDBC driver wrapper for your database. See Installation.
  2. Classify Attributes: define what you're protecting before you map anything to it, see Attributes & Attribute Groups.
  3. Define a Manifest: describe your data schema and map fields to the Attributes from step 2.
  4. Assign Policies and PETs: decide who can see what, and how it should be protected when they can't.
  5. Test: call the API directly, or exercise your application, to confirm data is being protected as expected.
  6. Monitor: use Metering to track usage and confirm policies are being enforced in production.

For the full governance setup, Countries and Claims in addition to Attributes, see the Platform Journey.

4. Go deeper

  • Products overview: full detail on APIgator, Datagator, GatorSet, and GatorAId.
  • Platform: the full step-by-step journey covering Attributes, Countries, Claims, Policies, Manifests, PETs, Filter Expressions, Vault, and Admin.
  • Installation guides: environment-specific setup, Kubernetes/Helm troubleshooting, driver installation.
  • API Spec: interactive reference for the Execution and Management APIs.
  • Release Notes: what's changed recently.
  • Help Center: task guides for getting access, creating applications, and getting support.