Data flows

Knowing where sensitive data lives and how it moves is the groundwork for a sound risk analysis. Data flows keeps two linked inventories: the systems and data assets that hold sensitive data, and the flows that move data between them.

Data flows is included in Premium and Enterprise, and it works

on the Free plan too. Exporting it comes with a paid plan.

Data assets

An asset is a system or platform that stores or processes data. Each records its type (application, database, file storage, training data store, feature store, vector store or retrieval index, model endpoint, SaaS AI tool, cloud service, messaging or collaboration, device, or Other for anything that does not fit), a data classification (personal data; sensitive personal data, for example health, biometric or religious data; confidential business data; internal business data; de-identified; or public. A new asset starts at internal business data, so choose a personal-data class when it holds personal data), the personal data elements it stores or processes (name, date of birth, address, phone, email, government ID, financial, health, biometric, location, or other), an optional data custodian, a retention period in days, and the system in your registry the asset is part of.

Protected health information

While a HIPAA assessment is offered, and unless your organization recorded that it handles no PHI, an asset can be classified as protected health information (PHI), and its elements include a Social Security number, a medical record number, a diagnosis, a treatment and health insurance. A PHI asset counts as personal data on the register. A flow's personal-data flag is the box you tick on the flow: while HIPAA applies it reads "Personal or sensitive data, PHI included", and it is not set for you from the assets the flow connects.

The datasets your AI systems and models are trained, tested or grounded on have their own register: see Datasets.

Data flows

A flow documents data moving from one place to another. Give it a label, a source and destination (pick from your assets or type a free-text endpoint), and a flow type (internal, external, third party, cloud, API, or manual). Flags record whether personal or sensitive data is transmitted and whether it is encrypted in transit and at rest. The page counts unencrypted sensitive flows so you can see exposure at a glance.

Who can do what

Org admins add and edit assets and flows. Contributors view them read-only. Read-only auditor accounts are refused this register entirely, on the page and on the CSV export alike: the map names where sensitive data lives and moves, and data flows are not one of the scopes an auditor link can grant. There are no due dates or recurrence here. The map is a living inventory you update as systems change.