Share-safe reports
Counts, rates and statistics, with ids and values withheld or digested with your own key. Typed notes are left out by default, because they can quote data values. Column, dataset and reviewer names stay.
For governance and compliance
Every approval, block and override, on the record.
Datainspec keeps who decided what, when and why, for every version of a dataset and every finding on it. On your machines, exportable when someone asks.
Sound familiar?
The questions that come after.
Who approved this version of the data, and when?
Why was this file let through last month?
Can we show the auditor what we checked, without sending them the data?
What it records
A trail you don't have to rebuild.
01
Approve a version, with its evidence
Before a version becomes the reference, a health check looks at the version itself: duplicate keys, empty or constant columns, numbers stored as text, placeholder codes. A critical one has to be acknowledged.
- Who approved it, and when
- An approval certificate for each version
- Compare two versions; a rollback adds a version, erasing nothing
02
A decision on every finding, with a reason
Real problem, expected change, noise or snooze. The person and the reason are kept, and shown again when the same finding comes back.
See triage
03
Blocks that keep their reason
A block with a reason stays until someone clears it, with a reason. Both sit in the gate's history, next to the scans that caused them.
See the gate
04
An audit log you can hand over
Approvals, blocks, rollbacks, role corrections and threshold overrides: who, when and why, for every dataset. Filter it, and export it as CSV.
See the audit step
How it fits your controls
Every step leaves a line in the record.
- 1A version is approvedAfter its health check, by a named person.
- 2A delivery is checkedAgainst that version; every finding with its evidence.
- 3A person decidesReal problem, expected or noise, with a reason; a block stays until cleared.
- 4The record is keptWho, when and why, exportable when someone asks.
The difference
From reconstructing to exporting.
Without it
With Datainspec
Approvals in email threads
Each approved version kept, with who, when and a certificate
“Why was it let through?” Nobody remembers
Every decision on a finding has a name and a reason
Audit preparation: rebuilding the trail
Filter the audit log, export it as CSV
Sending data to prove a check ran
A share-safe report: counts and statistics, no values
Sharing and separation
Proof without the data.
Air-gapped sites
A signed bundle carries a dataset's approved versions and decisions to an isolated system. The import trusts only the key you give it, and a dry run shows what it would change first.
SecurityNothing leaves
It runs where the data is and sends nothing to us: no data, no profile, no finding, no telemetry. It only reads your sources.
SecurityQuestions
What reviewers ask.
Can a rollback erase history?
No. A rollback adds a new version that copies an earlier one; every version stays in the timeline, with who approved it and when.
Is every decision tied to a person?
Yes. Approvals, blocks, clears, decisions on findings, threshold overrides and role corrections each keep the person, the time and the reason.
What exactly is in a share-safe report?
Counts, rates and test statistics, with ids and values withheld or replaced by digests. Column, dataset and reviewer names are kept; notes people typed are left out unless you choose to keep them.
Can approved baselines move to an isolated network?
Yes, as a signed bundle. The importing side verifies the signature with the public key it was given, can preview the import, and refuses a conflicting history instead of merging it silently.
Bring one dataset that gets audited.
We run it on your machines for a few weeks, then go through what it caught and what it recorded.