Attestation is named
Approving or revoking a grant records who decided and when. An unsigned decision is not evidence.
Approach
A governance tool must be worth trusting itself.
We ask for a connection to the systems holding your most sensitive data. That is a serious request, and it is only reasonable if the tool making it is built to deserve the access. The constraints below are the ones we hold ourselves to, stated plainly so that you can hold us to them.
Principle 01
We do not store your data. We store what it is.
To classify a column, something must look at a few values. Gravitas reads up to five, uses them to determine what the column holds, and then discards them. They exist in memory for the duration of a single scan and are never written down.
What is retained
The system name, the table, the column, the classification, and a coarse shape hint — email-like, 4-digit numeric, government-id-like. Each of those labels is a fixed string selected from a list.
Why that matters
A shape hint cannot leak a value. No fragment of what we read is embedded in what we save, so a breach of our inventory would expose the structure of your data and never its contents.
What you can verify
Examine any discovered field in the product. The sample column displays a shape, not a value. There is nowhere else the value could reside.
Principle 02
Read-only, enforced by your database rather than by our promise.
Scans open connections with read-only mode set as a server-side option and a statement timeout attached. Were our code ever to attempt a write, your database would refuse it. The guarantee lives on your side of the connection.
We ask you to go further still. Provide a least-privilege user with SELECT only, scoped to the specific schemas you want scanned. Defence in depth means not relying on any single control, including ours.
Principle 03
Credentials are encrypted, never returned, and scrubbed from errors.
Encrypted at rest
AES-256-GCM with a fresh nonce for every write. The authentication tag ensures that tampering fails closed rather than decrypting silently to something incorrect.
Never returned
No API response includes a stored credential in any form. The field is excluded at the query itself rather than filtered afterwards.
Scrubbed from errors
Database drivers will readily print connection strings into error messages. Ours are rewritten before they are displayed, stored, or logged — a failed connection reports authentication failed for user [redacted].
Principle 04
The system proposes; a person decides.
Gravitas uses AI to classify fields, assess access, and infer relationships. It does not act on any of it. Nothing is revoked, nothing is deleted, and no finding becomes a fact because software determined it.
History is immutable
Re-running a review never overwrites the previous one. Prior runs and the decisions within them remain exactly as they were.
Confirmation is not proof
Marking an inferred data flow as correct records your opinion. It never promotes a suggestion to verified lineage.
Principle 05
We state our limits.
Governance tooling has a habit of implying more certainty than it possesses. The limits below appear in the product itself, in the same place as the results they qualify, rather than in terms that nobody reads.
Readiness is an indicator
It helps you prioritise. It is not a certified audit and not a substitute for a qualified assessor. SOC 2 is supported most thoroughly; other frameworks are directional.
Lineage is inferred
Suggested relationships are based on names, shapes, and classification. Proving that data actually moves requires query logs or ETL pipelines, which we do not read.
Classification can be wrong
Every classification carries its reasoning, so that you can examine the judgement rather than trust the label. Ambiguous fields are marked unclear rather than guessed at.