Your vendors work without accessing personal data
Vendors, integrators and consultancies need to work with your data. GDPR makes them data processors and leaves you responsible for what they do with it.
The data leaves your perimeter and the responsibility doesn't
For procurement, legal counsel and information security teams.
Files that circulate with no control
A dump sent by email or a shared folder stops being traceable the moment it leaves.
Access that never closes
Credentials created for a project stay active months after it ended.
Contracts that verify nothing
A signed contract doesn't stop real data from reaching an environment you don't control.
The project stalls
When security blocks the delivery, the integrator waits. When it's unblocked without transforming it, the risk moves entirely.
The vendor receives a useful set, not a real one
Know what you were about to send
Classification identifies what personal information the set contains before it goes out.
Proof of what was delivered
The dictionary export documents what transformation was applied to each field.
Transform before sharing
Rules are applied inside your perimeter: the vendor never receives the original value.
A keyed endpoint, not a loose file
The set is downloaded in JSON, CSV or SQL and the key is revoked when it's done.
Questions about delivery to third parties
How does a vendor who doesn't use the platform access it?
The dataset is exposed on an endpoint with an API key, so the third party downloads the already-transformed set without needing an account. The key is revoked once access is no longer needed.
How does this relate to Article 28 of the GDPR?
Article 28 requires safeguards around the data processor. If the delivered set no longer contains personal data, what the third party gets to process is reduced. The specific assessment belongs to your legal counsel.
What if the vendor needs data with a realistic format?
Masking can preserve the format of the original value, and synthetic data is generated according to each field's type. If no link to the source can remain, synthetic data is used.
Share without moving the risk
We show you how a dataset is published for a third party and how access is revoked.