Find where your sensitive data lives

Goal

See every column that holds sensitive data in one list, organized by data source, schema, table and team. Use it to:

• answer "where is our personal data?" for a security review;
• find the columns nobody has reviewed yet;
• hand an auditor a file of it.

Prereqs

• Data assets that have been profiled. Profiling checks every column for sensitive data; an asset that has never been profiled has nothing to show.
• Any role in the workspace. All workspaces needs the super admin role.

Steps

1. Go to Data Assets and click Sensitive data. Above the table:

   • Sensitive columns is the count, by category.
   • Not reviewed yet is the suggestions nobody has tagged or dismissed.
   • Protected is the count of sensitive columns whose security checks passed on their latest run, with how many are failing a check or have none.
   • Data assets with sensitive data is the count out of the profiled assets.

2. Read the table. Each row is one column:

   • where it is: data source, schema, table, team;
   • its Category: PII, PHI, PCI, Credentials or Financial. A question mark (PII?) means the column is suggested and not yet reviewed;
   • the Confidence of the suggestion;
   • its Status: Not reviewed, Tagged or Marked not sensitive;
   • its Readers: how many accounts can read the table, and how many are AI or service accounts (see who can read);
   • its Protection, from the column's security checks: Protected (every check that has run passed), Check failing, Not run yet or No check. Hover it to see each check and how its latest run went.

   Sensitive columns explains what each category covers and how confidence is worked out.

3. Narrow the list from the column headers. For example:

   • pick Not reviewed under Status to see the review backlog;
   • pick No check and Check failing under Protection to see what still needs protecting;
   • pick one data source or team.

4. Click a row to open its data asset. Under Table Health, the Sensitivity column has Accept (tag the column) and Dismiss (mark it not sensitive) for each suggestion. Back on the map, the row's status has changed.

5. To see every workspace at once, choose All workspaces in the workspace selector while you're on the map (super admin only). A Workspace column appears. Clicking a row in another workspace switches to it first.

6. To export, click Export and choose CSV or Excel. The file has the rows that match the table's Category, Status, Protection, Data source and Team filters. The text filters (schema, table, column) aren't applied to the file.

Verify

• The map's rows match the Sensitivity column of each asset's Table Health.
• An exported file has one row per sensitive column, with the workspace, data source, schema, table, data asset, column, category, tag, confidence, status, protection, team and when it was profiled. It holds no values from your data.

Troubleshooting

Symptom	Cause	Fix
"Nothing profiled yet"	No data asset in the workspace has a completed profile.	Profile your data assets (the asset page's Profile button, or a schedule).
A column you expect isn't listed	The latest profile didn't find enough evidence: a column is suggested from its name, or once 40 % of its sampled values look sensitive.	Accept it isn't there, or tag the asset yourself. To hear when sensitive values start appearing in a column, set up a sensitive data alert.
A column reads No check	No security check is set on that column.	Open the asset and add one from the column's Add a rule menu (for example Masked, hashed or tokenized), then run it.
A dismissed column is still listed	Dismissed columns stay, as Marked not sensitive, so the decision is visible.	Filter Status to leave them out. They aren't counted in the summary.
All workspaces shows a role banner	The organization-wide map is for super admins.	Ask a super admin, or view one workspace at a time.
The export is refused as too large	Exports stop at 50,000 rows.	Filter by category, status, data source or team, then export again.