Glossary
Plain-English definitions of the core concepts, objects, and terminology used throughout the eXate platform.
For an overview of how the core eXate objects fit together, see the eXate Object Hierarchy.
eXate Concepts
Attribute
A reusable label that represents a type of sensitive data, for example Email, CreditCard, or Salary. You classify a field once as an Attribute, and every place that Attribute appears across your systems inherits the same default protection. Attributes are created inside an Attribute Group.
Attribute Group
A named collection of related Attributes, for example a Financial Data group containing Salary, BankAccount, and CreditCard. Grouping allows a Policy to protect an entire category of data instead of individual Attributes.
Claim
A condition supplied to eXate at request time, typically representing information such as a user's role, department, or application. Claims are evaluated against a Policy to determine whether unprotected access is permitted. Claims are organised into reusable Claim Packs. See Claim Packs.
Dataset
A collection of structured data submitted to or retrieved through eXate for protection. Depending on the product, a dataset may represent database tables, files, JSON documents, XML documents, CSV files, or API payloads.
Filter
A dynamic, fine-grained restriction that operates independently of Policies. Filters can redact, mask, tokenise, encrypt, or otherwise transform data when specific conditions are met. Filters are evaluated at the field level within a Manifest. The available Filter actions are published as Filter Expression Action metadata. See Filter Expression Action.
List
A reusable collection of values with two primary uses. A List can act as an access control list during Policy evaluation by matching request values against allowed or blocked entries. It can also supply substitute values for masking, allowing the same input value to consistently produce the same masked output. See List.
Manifest
Also called an Entitlement. Maps fields in a data source, such as database tables, JSON documents, XML documents, CSV files, or API payloads, to Attributes. A Manifest tells eXate how the data is structured and which fields require protection.
Meta Tag
A predefined, fixed piece of metadata, unlike a freeform key-value pair, a Meta Tag's name is standardised across the tenancy rather than left to drift between teams. Meta Tags attach to Manifests and Policies. The primary planned use is tagging a Policy with the regulation or internal policy driving it, for example GDPR (cross-border data-sharing rules) or DORA (cross-border operational-resilience rules), so Policies can be found by the requirement behind them.
PET
Privacy Enhancing Technology. The mechanism used to protect sensitive data, such as masking, tokenisation, encryption, redaction, or other protection techniques. PETs are grouped into reusable PET Groups (called SubPET Groups in the portal) and are applied to Attributes by default or overridden for individual fields.
Policy
Formerly known as a Rule or Rule Pack. Defines when sensitive data should be protected and when it may be returned unprotected based on Claims, country, Purpose of Use, and other request context. Policies determine which PETs are applied when access to unprotected data is not permitted. See Policies.
PoLP
Principle of Least Privilege. The security principle that users, applications, and services should receive only the minimum level of data access required to perform their task. eXate enforces PoLP by evaluating Policies and applying PETs whenever unrestricted access is not permitted.
Request Context
Metadata supplied with a request, such as Claims, Purpose of Use, country, SnapshotDate, or other runtime values, that eXate uses when evaluating Policies and Filters.
SnapshotDate
A seed value used by masking PETs to produce deterministic output, allowing the same input to generate the same masked result across repeated runs. Non-deterministic masking can be requested by specifying this in the request context. See Deterministic Masking and SnapshotDate.
General Terms
GDPR
General Data Protection Regulation. A legal framework governing the collection, processing, and protection of personal data within the European Union and the European Economic Area.
gRPC
An open-source, high-performance Remote Procedure Call (RPC) framework that uses Protocol Buffers for serialisation and HTTP/2 for transport. APIgator supports both REST and gRPC interfaces.
JSON
JavaScript Object Notation. A lightweight, human-readable format for representing structured data that is commonly used for data exchange between applications.
PII
Personally Identifiable Information. Information that can identify an individual, either on its own or when combined with other available information.
REST
Representational State Transfer. An architectural style for designing web services that communicate using standard HTTP methods.
Tokenisation
Also known as Pseudonymisation under GDPR. A privacy-enhancing technique that replaces sensitive values with surrogate values, or tokens, while preserving the structure and usability of the data. The mapping between the original value and its token is maintained securely, allowing authorised users or systems to recover the original value when required.