Log inRequest a demoStart free

Don’t take our word for it — verify it

Watch the boundary yourself, with your own tools.

Each claim below comes with a procedure you can run with your own tools, in your own environment. None of them requires talking to us.

Check the claims with your own toolsThe DataNivra agent's outbound traffic passes through a proxy you control before it reaches DataNivra Cloud, so you can inspect every message. From there you can confirm that canary values never leave, that the agent only connects outbound, and that the audit chain verifies.Your networkagentYour proxyyou inspect itDataNivraCloudCanary values never show up outsideThe agent only connects outboundThe audit chain verifies end to end

Contents

Watch the boundary in the browser demo

Claim: Row-level work happens on the customer side; the cloud sees metadata only.

The interactive demo runs entirely in your browser on synthetic data. At every step its cloud panel lists the exact messages the control plane would receive — identifiers, counts, gate outcomes — next to the row-level work that stays local. Open your browser's developer tools while you use it: the demo makes no network request with your interactions.

Plant canary values and search for them

Claim: Zero raw-production-data egress.

  1. In a non-production copy of a source, plant a few unique, obviously synthetic values (for example CANARY-7Q4Z-EMAIL@example.invalid in an email column and CANARY-7Q4Z-NOTE in a free-text column).
  2. Run discovery, then a full dataset job (subset, mask, certify, provision).
  3. Search everything the control plane shows you — console pages, API responses, audit exports, evidence metadata — and your proxy logs of the agent's outbound traffic:
# API responses you can read with your own token (examples)
curl -s -H "Authorization: Bearer $TOKEN" "$API/v1/audit-events" | grep -c 'CANARY-7Q4Z'
# Agent traffic recorded by your TLS-inspecting proxy
grep -c 'CANARY-7Q4Z' /var/log/proxy/datanivra-agent.log

Every count should be zero. Our own end-to-end journeys plant canary values the same way and fail if one ever appears in control-plane rows, logs, traces or API responses.

Prove the network is outbound-only

Claim: DataNivra never connects into your network.

The agent opens no listening port. Give its host or pod a firewall policy that denies all inbound traffic and allows outbound TCP 443 only to your control-plane endpoint, container registry and secret store (plus your sources and targets inside the network). The agent keeps working — it polls for leased work — and your firewall logs show no inbound session. The Docker, Helm and Terraform packages on the downloads page already deny inbound traffic.

Inspect every message with your own proxy

Claim: Only classified metadata, aggregates and evidence leave the boundary.

Route the agent through a TLS-intercepting proxy you control and trust its certificate authority in the agent:

HTTPS_PROXY=http://proxy.internal:3128
NO_PROXY=.internal
DATANIVRA_AGENT_CA_BUNDLE=/etc/datanivra/corp-ca.pem

Every request body is JSON of a documented, versioned message schema. Compare what you capture with the field classification register: each field is control metadata, an aggregate metric, evidence metadata or a secret reference — never a value from your data.

Read the EgressGuard violation log

Claim: Outgoing messages are checked before they leave, and rejected ones are recorded.

Before sending, the agent checks each message against the allowed schemas and content detectors (email addresses, card numbers, national-identifier and IBAN shapes, phone numbers, names, dates, addresses, encoded values). A rejected message is not sent; it is recorded locally with rule codes and field paths, without the payload:

docker exec datanivra-agent python -m datanivra_agent.cli violations
# or, where the entry point is on PATH:
datanivra-agent violations

Check read-only source access

Claim: Sources are read with read-only credentials.

For PostgreSQL the agent proves read-only access from the catalog (read-only session, no superuser or role-creation rights, no table write or CREATE privilege) before reading a production source, and refuses otherwise with SOURCE_NOT_READ_ONLY. For object stores, which cannot report permissions, it requires your explicit attestation. Test it: register a source with a credential that can write and watch the job fail closed. Each connector's proof is listed on the integrations pages.

See certification refuse an unsafe dataset

Claim: Failed or revoked datasets are never provisioned.

In the demo, choose to leave a sensitive column unmasked: the certification gate fails and provisioning is refused. In your own environment, remove a masking rule for a classified column and run a job — the dataset is marked FAILED, cannot be provisioned, and the evidence records which gate failed.

Confirm masking is deterministic and keyed

Claim: Joins survive masking; the key stays with you.

Run the same job twice with the same masking key: the same source value masks to the same output in every table, so joins keep working, and the datasets match column for column. Rotate the key in your secret store and run again: the outputs change, because the key never leaves your environment and DataNivra cannot reproduce the mapping.

Verify the audit chain

Claim: Audit events are tamper-evident.

Audit events form a hash chain per tenant. Any user with audit access can ask the control plane to re-verify every link:

curl -s -H "Authorization: Bearer $TOKEN" "$API/v1/audit-events/verify"
# → {"tenant_id": "…", "events_checked": …, "intact": true, "first_broken_sequence": null, …}

Benchmarks

We have not published performance numbers, because no benchmark has yet been run in a reproducible environment. When it has, results will be published together with the harness, the synthetic dataset definition and the environment, so you can re-run them. The reproducible benchmark harness is documented in the repository under docs/benchmarks/README.md.

Go further

Read the security overview and the architecture, check the support center for error codes, or start free and run these checks in your own trial.