Metadata leaks. Column names, classifications and profile statistics describe the data precisely enough to be worth attacking, so the catalog is classified at the level of the most sensitive asset it describes.
No data values are persisted. Profile statistics are bounded, and no sample values are stored at all for confidential or restricted assets.
The ingestion agent holds read-only source credentials in a KMS-backed vault and connects outbound only; the platform never holds a write path into a source.
Controls
OIDC with MFA for people, client credentials for automation, mTLS between services.
ABAC on domain plus sensitivity label; per-domain index aliases so a search cannot reach outside an entitlement.
Encryption at rest with customer-managed keys, TLS 1.3 in transit, annual key rotation.
Residual risk
A broad service principal is the most attractive target in the system — it can enumerate the entire estate. Automation credentials are scoped per domain, short-lived, and their read volume is baselined and alerted on.
