Shipped vs. roadmap
Most vendors in this category will tell you what their product does and let you discover the gaps during a trial. We publish the boundary instead.
Two reasons, and the second is the honest one. First, you are evaluating a governance tool — a tool whose entire value is that it tells you the truth about your data. A governance tool that oversells itself has already failed its own premise. Second, we would rather lose a deal in week one for something we don't do than lose it in week six for something we said we did.
This page is maintained against our internal feature tracker and reviewed on every release, so it moves when the product moves rather than when marketing gets around to it. Last reviewed: 2026-08-21.
How to read this
Shipped means you can do it today, in a demo, on your own data. If you ask us to prove any line in that table on a call, we can. In deployment means the code is written and the rollout isn't finished. Not yet means not yet — no partial credit.
Shipped — provable in a demo
Profiling and ingestion
| Capability | Notes |
|---|---|
Excel (.xlsx), CSV, JSON, XML profiling | Header rows detected automatically; banner and title rows above the table are skipped |
| Automatic type, format, null-rate, and cardinality detection | Across the whole file, not a sample of ten rows |
| Database sources | PostgreSQL, MySQL, SQL Server, Snowflake, BigQuery, Databricks |
| Other sources | OpenAPI/URL, PDF/HTML extraction, webhook capture, Tally XML |
| Layout fingerprinting | Next month's file with the same columns routes to the mapping you already built |
Mapping and transformation
| Capability | Notes |
|---|---|
| Natural-language transformation rules | Compiled to reviewable code, not executed as a prompt at runtime |
| Code generation in 6 targets | Python, SQL, JSONata, XSLT, TypeScript, Java — with golden tests |
| Multi-source joins and array/N↔N cardinality mapping | |
| Live preview against your own sample data | |
| AI suggestions with a verifier | The model proposes; a deterministic checker accepts or rejects |
Running pipelines and governance
| Capability | Notes |
|---|---|
| Scheduled and event-triggered runs | |
| Schema-drift detection with a proposed fix | CSV, Excel, JSON, XML sources; you approve every change |
| Zero-loss passthrough | A column nobody told you about is preserved, not dropped, on the first run it appears |
| Row-level validation | Six built-in validators plus your own; failures are held, not dropped |
| Quarantine with fix-and-retry | A held row shows the reason and its origin; fix a cell, retry, and the next run re-ingests it |
| Per-row provenance | Every delivered row names the file, sheet, and row it came from |
| Per-field rule provenance | Every target field records the rule that produced it and the fields that rule read |
| Durable audit log | Policy changes, PII detection, detokenization, drift, run outcomes, quarantined records |
| PII detection with human review | Detected fields are proposed; nothing is enforced until you confirm. Today's deployed build matches on field names and value patterns; deeper value-level NER is an optional component we have not enabled yet |
| Masking, tokenization, redaction | Enforced on real runs and exports, not just preview |
| Per-tenant isolation | Application scoping plus database row-level security on customer-data tables |
| Delivery targets | PostgreSQL, Snowflake, BigQuery, SFTP, file, webhook; JSON, CSV, XML, EDI, HL7 output formats |
In deployment — built, rollout unfinished
| Capability | What's missing |
|---|---|
| Hardened microVM-class execution isolation | The client and dispatch path are built; the isolated runner is not deployed, so today's transformation code runs in a restricted in-process interpreter |
| Managed KMS integration | Keys are held outside the database and injected at runtime today; the AWS/GCP KMS swap is isolated to one function |
| Row-level-security hardening | Policies are in place; production verification against a dedicated non-superuser role is outstanding |
| LLM observability | Tracing is wired through every model call site; the collector is not yet enabled in production |
Not yet — on the roadmap
| Capability | Where it stands |
|---|---|
| End-to-end lineage graph | Field-level provenance and run-level audit records exist today. A full multi-hop lineage graph, and export into a data catalog via OpenLineage, do not. This is the single biggest gap between what this category usually claims and what any of us can actually show you |
| EDI X12 and HL7 v2 as sources | Both ship today as output formats and as drift validators. Reading an EDI or HL7 feed as a source is not built |
| Warehouse-table drift probes | Drift detection is live for file-based sources. Row-count and schema probes against warehouse tables are not |
| Data-catalog pull (Collibra, Alation, Atlan) | Not started |
| Inbound email-drop ingestion | Not started |
| Regional PII entity packs (DPDP, GDPR) | The detector's entity set is currently US-centric (SSN, passport, driver's licence). Indian and EU identifier packs are not built |
| SOC 2 Type II certification | Controls are designed against the Trust Services Criteria and no audit has been completed. A DPA is available on request |
See Data privacy & security for how the controls that are live actually work.
Things we've decided not to build
Not gaps — choices. Knowing what a tool refuses to do tells you more about it than its feature list.
- A general-purpose workflow automation builder. If you need Zapier, use Zapier. We connect to it rather than competing with it.
- A data catalog. We will emit lineage into yours. We won't ask you to adopt another inventory of your data.
- An orchestrator. We run pipelines and expose triggers. Airflow, Dagster, and your scheduler keep their jobs.
- AI in the runtime path. Models help you author a mapping. They never sit between your data and your target at run time, because a non-deterministic step in a governed pipeline is not governable.
What's next
- Data privacy & security — the controls, and their current limits, in detail.
- How the products fit together — profile, map, deploy.