Ubiq Overview

Ubiq is an identity-driven data security platform for discovering sensitive data, mapping identity-to-data access, and enforcing data protection policies at runtime.

The platform includes three core capabilities:

Sensitive Data Discovery: Finds and classifies sensitive data across supported enterprise data sources
Access Mapping: Maps relationships between identities, groups, datasets, and sensitive data
Runtime Data Protection: Encrypts, tokenizes, masks, or reveals sensitive data based on identity, context, and dataset policy

Ubiq supports applications, databases, data warehouses, APIs, analytics and BI tools, data pipelines, and AI workflows.

Platform Capabilities

Sensitive Data Discovery

Sensitive Data Discovery scans supported enterprise data sources to identify and classify sensitive information.

Discovery results show:

Where sensitive data is located
What types of sensitive data were detected
Which datasets, tables, fields, objects, or files contain it
Whether detected data is protected or unprotected
The confidence and supporting context for each finding

Discovery can be used to maintain an inventory of sensitive data, identify potential exposure, and determine where additional protection may be required.

Supported discovery sources vary by connector. Discovery coverage may include structured, semi-structured, and unstructured data sources.

Access Mapping

Access Mapping shows how identities, groups, datasets, and sensitive data are connected.

It provides visibility into:

Human and non-human identities associated with sensitive data access
Identity groups and access relationships
Datasets accessed by each identity
Identities associated with each dataset
Protected and unprotected sensitive data activity
New, unusual, or unexpected access patterns

Access Mapping uses identity, dataset, and activity information available through Ubiq and its supported integrations.

It does not replace the underlying IAM, IGA, database, or application authorization system.

Runtime Data Protection

Runtime Data Protection controls what sensitive data each human or non-human identity can see and use when data is accessed.

Ubiq evaluates the requester’s identity, group membership, dataset policy, requested operation, and available runtime context. Based on that decision, the same sensitive value can be:

Revealed in cleartext
Partially or fully masked
Tokenized
Encrypted or kept protected

This allows different users, applications, service accounts, APIs, analytics tools, and AI workflows to receive different versions of the same data based on policy.

Ubiq supports two primary deployment models:

Protection in storage: Encrypt or tokenize sensitive data before it is stored
Protection at access time: Transform the data returned through an application, API, analytics tool, BI platform, or AI workflow without requiring the stored value to be protected

Depending on the integration, Ubiq can enforce policy when data is written, read, queried, returned, or otherwise processed.

Runtime Data Protection is primarily designed for structured and semi-structured data.

Protection in Storage or at Access Time

Ubiq can enforce data protection at different points in the data path. Customers are not required to use the same deployment model for every system or use case.

Protection in Storage

Ubiq can encrypt or tokenize sensitive data before it is written to a database, data warehouse, or other supported data store.

The protected value remains stored in the underlying system and is revealed or transformed only through an authorized Ubiq operation.

This model helps protect sensitive data from direct access to the underlying data store, including access that bypasses the application or normal access path.

Protection at Access Time

Ubiq can also integrate with an application, API gateway, analytics tool, BI platform, or AI workflow and apply policy when data is requested.

In this model, the underlying data does not need to be encrypted or tokenized in storage. Ubiq determines whether the requester receives cleartext, masked, tokenized, or otherwise protected data at runtime.

This model is useful when the customer wants identity-driven control over the data returned through a specific application or workflow without changing how the source data is stored.

Security consideration: Access-time enforcement controls data returned through the integrated application, API, analytics, or AI path. If the underlying data remains in cleartext, users or administrators with direct access to the data store may still be able to view it. Protecting data in storage provides additional protection against access that bypasses the integrated runtime path.

The appropriate model depends on the customer’s threat model, architecture, integration point, and security requirements.

Runtime Enforcement Flow

Every runtime protection operation passes through an identity-aware decision flow.

Request Initiation: A human or non-human identity requests access to sensitive data through an application, database, API, analytics tool, or AI workflow
Local Data Access Point: The request reaches the application, database, API gateway, data platform, or workflow where the Ubiq integration is installed
Request Context: The local integration receives the requester identity, requested operation, dataset, field, and available runtime context
Identity Validation: Ubiq validates the supplied identity and group context
Policy Evaluation: Ubiq identifies the applicable dataset policy and determines which operation or data output is permitted
Local Protection Operation: Ubiq performs the required encryption, decryption, tokenization, detokenization, masking, or reveal operation locally
Result Returned: The requester receives the result permitted by policy, such as cleartext, masked data, tokenized data, or data that remains protected
Event Recording: Ubiq records the identity, dataset, operation, policy decision, and outcome for audit and security visibility

The Ubiq integration runs within the customer environment at the data access point. Sensitive data does not need to be routed through an external Ubiq proxy.

The identity provider supplies identity and group information but does not need to be called inline for every runtime data operation. The exact identity flow depends on the integration and customer architecture.

Integration Coverage

Ubiq can be integrated at different points in the data access path.

Applications and Microservices

Ubiq SDKs and libraries can be integrated directly into application code or shared application services.

The application can use Ubiq to protect data before it is stored or to apply identity-driven transformations when data is accessed.

Access-time integration does not require the underlying database value to be encrypted or tokenized.

The application provides the identity, dataset, requested operation, and available runtime context when calling Ubiq.

Databases

Ubiq can be integrated with supported SQL and NoSQL databases to protect data when it is written, read, or processed.

Database-layer integrations can store encrypted or tokenized values in the underlying database. This helps protect the data from direct database access, including access that bypasses the application.

The exact deployment model and effect on database operations depend on the database, protection method, and use case.

Data Warehouses and Data Platforms

Ubiq supports integrations with selected data warehouses and data platforms used for analytics, reporting, and data processing.

Depending on the integration, Ubiq can protect data before storage or apply identity-driven transformations when data is queried or returned.

API Gateways

Ubiq can apply identity-driven protection and unprotection operations through supported API gateway integrations.

This allows data to be revealed, masked, tokenized, or kept protected as it passes through the API access path.

It does not require the underlying source system to store protected values.

Analytics and BI

Ubiq can control the sensitive data returned through supported analytics and BI integrations.

Different users or workloads can receive cleartext, masked, tokenized, or protected data based on policy.

The underlying data platform does not need to store encrypted or tokenized values for this access-time enforcement model.

AI and Automated Workflows

Ubiq can apply runtime data policies to AI agents, RAG pipelines, MCP workflows, notebooks, service accounts, APIs, and other automated systems.

These systems can be represented as non-human identities and mapped to dataset policies.

Ubiq evaluates identity, context, and policy before returning data to the AI workflow.

This allows sensitive data to be transformed at access time without requiring the source database, warehouse, or application to store a protected version of the data.

Supported capabilities and deployment methods vary by integration.

Identity and Access Models

Ubiq uses identity context to determine which data operation or output is permitted.

Identity information may come from:

Okta
Microsoft Entra ID
Application-provided identity
Service or workload identity
API credentials
Ubiq API access credentials

Human and non-human identities can be mapped to Ubiq groups and dataset policies.

The identity source remains authoritative for the identity and its group membership. Ubiq uses that context to enforce policies associated with datasets governed by Ubiq.

Ubiq does not need to sit inline between the requester and the application, database, or data platform.

Deployment Architecture

Ubiq uses a hybrid SaaS architecture with a Ubiq control plane and locally deployed integrations.

Ubiq Control Plane

The control plane provides:

Dataset and policy configuration
Identity and group mappings
Sensitive Data Discovery configuration and results
Access Mapping and data activity visibility
Key orchestration and management
Event and security history

Customer Environment

The customer environment contains:

Locally installed Ubiq libraries, connectors, or integrations
Local cryptographic and data-transformation operations
Authorized runtime key material and cached configuration
Customer-controlled HSM or KMS infrastructure where configured

Ubiq does not require sensitive data to be moved into a centralized vault or routed through an external proxy for runtime protection.

Ubiq can provide managed, HSM-backed key infrastructure or support customer-controlled HSM and KMS configurations where applicable.

Deployment requirements vary by integration point, protection method, and whether data is protected in storage or when accessed.

Data Protection Methods

Ubiq supports multiple protection methods through a common dataset and policy model.

Tokenization and Format-Preserving Encryption

Tokenization and format-preserving encryption replace sensitive values with protected values that retain the format required by the application or data system.

These methods can be used when applications or workflows do not require access to the original value and can reduce application, schema, and workflow changes for supported use cases.

Masking

Masking returns a modified representation of a sensitive value.

Policies can apply full or partial masking based on the identity, dataset, and use case.

Encryption

Ubiq supports standard encryption for data that does not need to retain its original format.

Encryption and decryption are performed locally through the installed integration.

Key Management

Ubiq manages key use through dataset policies and locally deployed integrations.

Key-management options include:

Ubiq-managed HSM-backed key infrastructure
Customer-controlled cloud KMS
Customer-controlled HSM
Customer-managed key configurations supported by the integration

Cryptographic operations are performed locally within the customer environment.

The exact handling of master keys, wrapped keys, derived keys, and cached key material depends on the selected architecture and integration.

Audit and Security Visibility

Ubiq records runtime data-protection activity for audit and security analysis.

Recorded information may include:

Event ID
Timestamp
Human or non-human identity
Identity group
Dataset and field
Requested operation

Events can be reviewed through Ubiq and exported to supported security and monitoring systems.

Access Mapping uses this activity to show identity-to-dataset relationships and highlight new or unusual access patterns.

Data Coverage and Limitations

Sensitive Data Discovery and Runtime Data Protection support different data sources and data types.

Sensitive Data Discovery may scan supported structured, semi-structured, and unstructured data sources.

Runtime Data Protection is primarily intended for structured and semi-structured data accessed through applications, databases, data warehouses, APIs, analytics tools, and automated workflows.

Ubiq is not intended to replace endpoint document rights management or productivity-file protection for Office documents, PDFs, images, laptops, or collaboration platforms.

Refer to the documentation for each connector or integration for supported capabilities, deployment requirements, and limitations.