Mainframe files (EBCDIC / copybook) test data, inside your network

What works today

Built-in connector for mainframe record files described by COBOL copybooks: EBCDIC code pages, fixed and variable-length records, zoned and packed decimal (COMP-3) and binary fields, decoded inside your network into the same masking and certification workflow.

Declare each dataset with its record file, copybook, record format (F, FB, V, VB) and code page (cp037 by default). Cross-system identity masking domains apply to mainframe fields exactly as to modern sources.

Authentication: filesystem permissions.

Known limitations

• Verified with synthetic EBCDIC datasets written by DataNivra's own record encoder; not yet verified against unload files produced on a z/OS system.
• Reads unloaded extract files (QSAM/VSAM unloads) from a landing directory; it does not connect to z/OS, VSAM or Db2 for z/OS directly.
• REDEFINES, OCCURS DEPENDING ON and floating-point (COMP-1/COMP-2) items are refused with a reason code.
• Variable-length (V/VB) files are read in one pass up to a configurable size limit.
• Files carry no keys: relationships come from industry-pack templates or explicit mappings.

Capability matrix

Each capability is tracked separately and shown at the level the recorded conformance evidence supports. A connector that only discovers metadata is never presented as equivalent to one that runs the whole workflow.

Read-only proof

Verified from filesystem permissions: the agent user must not be able to write the landing directory that holds the extracts and copybooks.

Conformance evidence

DataNivra runs every connector through a common conformance kit on synthetic data: no write statements, proven read-only access, secret redaction, schema and relationship discovery, bounded streaming, cancellation, clear reason codes, egress canaries and no raw values in logs, then the discover, mask, subset, certify and provision workflow. The published status is computed from those results.

Connector version 0.1.0, last verified 2026-09-30.

What crosses the boundary

Connectors run inside the agent in your network. Only metadata, aggregates and evidence reach DataNivra Cloud:

• Schema, table and column names and data types (for file sets, operator-declared or opaque table names — never data-derived file names).
• Aggregates such as row-count estimates, null and distinct ratios; counts from 1 to 10 are reported as 10 (small-cell protection).
• Classification findings (which column looks like which kind of sensitive data) and relationship metadata.
• Evidence metadata: checksums, gate outcomes, engine and policy versions, and templated error codes.

Never sent:

• Any cell value, row, sample, minimum/maximum or top-k value — masked or not.
• Credentials, connection strings or resolved secret values: DataNivra stores only the secret reference.
• Free text copied from your data, or exception messages that contain values.

See the customer-resident architecture and how to verify these claims yourself.