Skip to content

Datagator Overview

Datagator provides real-time, policy-driven protection for data queried from relational databases. It integrates at the JDBC or wire protocol layer, allowing existing applications to enforce eXate Manifests, Policies, data sovereignty requirements, and Privacy Enhancing Technologies (PETs) without requiring changes to application code or the underlying database.

For every query, Datagator evaluates the configured Manifest, Policies, request context, and applicable data sovereignty requirements to determine:

  • Which rows the requester is authorised to access.
  • Which columns require protection.
  • Which Privacy Enhancing Technologies (PETs) should be applied.
  • Whether data sovereignty or residency requirements affect how protection is performed.
  • Whether row-level security can be enforced by Datagator or delegated to the underlying database where native support is available.

Datagator supports distributed policy enforcement. Privacy Enhancing Technologies (PETs) can be executed by the eXate Protection Engine or delegated to services running within specific jurisdictions or on customer-managed infrastructure. This enables compliance with data sovereignty requirements, supports Hold Your Own Key (HYOK) deployments, and allows organisations to retain control of cryptographic operations where required.

The protected result set is then returned to the calling application, ensuring the Principle of Least Privilege (PoLP) is consistently enforced.

Key Capabilities

  • Real-time protection of relational database queries.
  • Integration using JDBC or native wire protocols.
  • Policy-driven enforcement using Manifests and Policies.
  • Enforcement of row-level and column-level access controls.
  • Dynamic query rewriting where required.
  • Support for native database row-level security where available.
  • Real-time masking, tokenisation, encryption, decryption, and other Privacy Enhancing Technologies (PETs).
  • Distributed execution of PETs to support data sovereignty and Hold Your Own Key (HYOK) deployments.
  • Minimal changes required to existing applications.

Data Query Flow

Datagator intercepts database requests before they are executed and communicates with the eXate Protection Engine to evaluate the configured Manifest, Policies, request context, and data sovereignty requirements.

Depending on the database platform and configuration, Datagator may rewrite the query, enforce row-level access controls, or push row-level security predicates to the underlying database where native support is available.

Once the query has been executed, Datagator applies any required Privacy Enhancing Technologies (PETs) to the returned data. Depending on the configured deployment, these operations may be performed by the eXate Protection Engine or delegated to services running within a specific jurisdiction or on customer-managed infrastructure before the protected result set is returned to the calling application.

sequenceDiagram
    autonumber
    actor App as Application
    participant DG as Datagator
    participant PE as eXate Protection Engine
    participant DB as Database

    App->>DG: Execute SQL query
    DG->>PE: Evaluate Manifest, Policies, request context, and sovereignty requirements
    PE-->>DG: Query modifications and protection requirements

    DG->>DB: Execute query
    DB-->>DG: Return result set

    DG->>PE: Apply required PETs
    PE-->>DG: Return protected data

    DG-->>App: Return protected result set

Query Execution

  1. An application submits a SQL query through a JDBC or supported wire protocol connection.
  2. Datagator intercepts the request before it reaches the database.
  3. Datagator sends the query, request context, and relevant metadata to the eXate Protection Engine.
  4. The Protection Engine evaluates the configured Manifest, Policies, request context, and applicable data sovereignty requirements to determine any required row-level filtering, column-level protection, query modifications, and Privacy Enhancing Technologies (PETs).
  5. Where supported, row-level security predicates may be pushed to the database's native row-level security implementation. Otherwise, Datagator enforces the required filtering.
  6. Datagator executes the resulting query against the database.
  7. The database returns the requested result set.
  8. Datagator applies any required Privacy Enhancing Technologies (PETs). Depending on the deployment, these may be executed by the eXate Protection Engine or delegated to services running within specific jurisdictions or on customer-managed infrastructure to satisfy sovereignty or Hold Your Own Key (HYOK) requirements.
  9. The protected result set is returned to the calling application.

Documentation

For step-by-step configuration and integration guides, see: