Ubiq Overview

Ubiq is an identity-driven data security platform for discovering sensitive data, understanding effective identity-to-data access, and enforcing data protection policies at runtime.

The platform includes three core capabilities:

Sensitive Data Discovery: Finds and classifies sensitive data across supported enterprise data sources
Access Intelligence: Resolves effective access across connected enterprise systems, showing what human and non-human identities can access, how that access is granted, and why.
Runtime Data Protection: Encrypts, tokenizes, masks, or reveals sensitive data based on identity, context, and dataset policy

Ubiq supports applications, databases, data warehouses, APIs, analytics and BI tools, data pipelines, and AI workflows.

Platform Capabilities

Sensitive Data Discovery

Sensitive Data Discovery scans supported enterprise data sources to identify and classify sensitive information.

Discovery results show:

Where sensitive data is located
What types of sensitive data were detected
Which datasets, tables, fields, objects, or files contain it
Whether detected data is protected or unprotected
The confidence and supporting context for each finding

Discovery can be used to maintain an inventory of sensitive data, identify potential exposure, and determine where additional protection may be required.

Supported discovery sources vary by connector. Discovery coverage may include structured, semi-structured, and unstructured data sources.

Access Intelligence

Access Intelligence provides visibility into effective access across connected enterprise systems.

It ingests and normalizes authorization metadata from supported identity providers, IGA platforms, cloud environments, databases, data warehouses, applications, and other enterprise systems to determine what human and non-human identities can access and why.

Access Intelligence resolves direct and indirect access relationships across identities, groups, roles, policies, permissions, and resources.

It provides visibility into:

Resources accessible by a human or non-human identity
Identities capable of accessing a specific resource
Direct, inherited, nested, and indirect access paths
Groups, roles, policies, and permissions contributing to effective access
Privileged, broad, excessive, or otherwise risky access where supported by source data
The authorization path explaining why access exists

Investigations can begin with either an identity or a resource and trace the complete access path in either direction.

Access Intelligence operates independently of Sensitive Data Discovery and Runtime Data Protection. When combined with Sensitive Data Discovery, sensitivity and classification information can be overlaid onto the access graph to show which identities can access sensitive data.

Access Intelligence does not replace the customer’s IAM, IGA, PAM, database, cloud, or application authorization systems. Those systems remain authoritative for access configuration and enforcement.

Runtime Data Protection

Runtime Data Protection controls what sensitive data each human or non-human identity can see and use when data is accessed.

Ubiq evaluates the requester’s identity, group membership, dataset policy, requested operation, and available runtime context. Based on that decision, the same sensitive value can be:

Revealed in cleartext
Partially or fully masked
Tokenized
Encrypted or kept protected

This allows different users, applications, service accounts, APIs, analytics tools, and AI workflows to receive different versions of the same data based on policy.

Ubiq supports two primary deployment models:

Protection in storage: Encrypt or tokenize sensitive data before it is stored
Protection at access time: Transform the data returned through an application, API, analytics tool, BI platform, or AI workflow without requiring the stored value to be protected

Depending on the integration, Ubiq can enforce policy when data is written, read, queried, returned, or otherwise processed.

Runtime Data Protection is primarily designed for structured and semi-structured data.

Protection in Storage or at Access Time

Ubiq can enforce data protection at different points in the data path. Customers are not required to use the same deployment model for every system or use case.

Protection in Storage

Ubiq can encrypt or tokenize sensitive data before it is written to a database, data warehouse, or other supported data store.

The protected value remains stored in the underlying system and is revealed or transformed only through an authorized Ubiq operation.

This model helps protect sensitive data from direct access to the underlying data store, including access that bypasses the application or normal access path.

Protection at Access Time

Ubiq can also integrate with an application, API gateway, analytics tool, BI platform, or AI workflow and apply policy when data is requested.

In this model, the underlying data does not need to be encrypted or tokenized in storage. Ubiq determines whether the requester receives cleartext, masked, tokenized, or otherwise protected data at runtime.

This model is useful when the customer wants identity-driven control over the data returned through a specific application or workflow without changing how the source data is stored.

Security consideration: Access-time enforcement controls data returned through the integrated application, API, analytics, or AI path. If the underlying data remains in cleartext, users or administrators with direct access to the data store may still be able to view it. Protecting data in storage provides additional protection against access that bypasses the integrated runtime path.

The appropriate model depends on the customer’s threat model, architecture, integration point, and security requirements.

Runtime Enforcement Flow

Every runtime protection operation passes through an identity-aware decision flow.

Request Initiation: A human or non-human identity requests access to sensitive data through an application, database, API, analytics tool, or AI workflow
Local Data Access Point: The request reaches the application, database, API gateway, data platform, or workflow where the Ubiq integration is installed
Request Context: The local integration receives the requester identity, requested operation, dataset, field, and available runtime context
Identity Validation: Ubiq validates the supplied identity and group context
Policy Evaluation: Ubiq identifies the applicable dataset policy and determines which operation or data output is permitted
Local Protection Operation: Ubiq performs the required encryption, decryption, tokenization, detokenization, masking, or reveal operation locally
Result Returned: The requester receives the result permitted by policy, such as cleartext, masked data, tokenized data, or data that remains protected
Event Recording: Ubiq records the identity, dataset, operation, policy decision, and outcome for audit and security visibility

The Ubiq integration runs within the customer environment at the data access point. Sensitive data does not need to be routed through an external Ubiq proxy.

The identity provider supplies identity and group information but does not need to be called inline for every runtime data operation. The exact identity flow depends on the integration and customer architecture.

Integration Coverage

Ubiq can be integrated at different points in the data access path.

Applications and Microservices

Ubiq SDKs and libraries can be integrated directly into application code or shared application services.

The application can use Ubiq to protect data before it is stored or to apply identity-driven transformations when data is accessed.

Access-time integration does not require the underlying database value to be encrypted or tokenized.

The application provides the identity, dataset, requested operation, and available runtime context when calling Ubiq.

Databases

Ubiq can be integrated with supported SQL and NoSQL databases to protect data when it is written, read, or processed.

Database-layer integrations can store encrypted or tokenized values in the underlying database. This helps protect the data from direct database access, including access that bypasses the application.

The exact deployment model and effect on database operations depend on the database, protection method, and use case.

Data Warehouses and Data Platforms

Ubiq supports integrations with selected data warehouses and data platforms used for analytics, reporting, and data processing.

Depending on the integration, Ubiq can protect data before storage or apply identity-driven transformations when data is queried or returned.

API Gateways

Ubiq can apply identity-driven protection and unprotection operations through supported API gateway integrations.

This allows data to be revealed, masked, tokenized, or kept protected as it passes through the API access path.

It does not require the underlying source system to store protected values.

Analytics and BI

Ubiq can control the sensitive data returned through supported analytics and BI integrations.

Different users or workloads can receive cleartext, masked, tokenized, or protected data based on policy.

The underlying data platform does not need to store encrypted or tokenized values for this access-time enforcement model.

AI and Automated Workflows

Ubiq can apply runtime data policies to AI agents, RAG pipelines, MCP workflows, notebooks, service accounts, APIs, and other automated systems.

These systems can be represented as non-human identities and mapped to dataset policies.

Ubiq evaluates identity, context, and policy before returning data to the AI workflow.

This allows sensitive data to be transformed at access time without requiring the source database, warehouse, or application to store a protected version of the data.

Supported capabilities and deployment methods vary by integration.

Identity in the Ubiq Platform

Identity is used differently across Access Intelligence and Runtime Data Protection.

Identity for Access Intelligence

Access Intelligence uses identity and authorization information from connected enterprise systems to understand effective access to data and resources.

Depending on the integration, Ubiq may ingest and normalize information about:

Human identities
Non-human identities, including service accounts, workloads, applications, and AI agents
Groups and nested group memberships
Roles
Policies
Permissions and entitlements
Resource assignments
Other authorization relationships exposed by the connected system

The connected identity, authorization, and resource systems remain authoritative. Ubiq uses their metadata to build an identity-to-resource access graph and resolve how access is granted.

Access Intelligence can trace direct and indirect access paths across identities, groups, roles, policies, permissions, and resources. This allows investigations to begin with either an identity or a resource and answer questions such as what an identity can access, who can access a resource, and why that access exists.

Access Intelligence operates independently of Sensitive Data Discovery and Runtime Data Protection. When combined with Sensitive Data Discovery, Ubiq can overlay sensitivity and classification context onto the access graph to identify which identities can access sensitive data.

Identity for Runtime Data Protection

Runtime Data Protection uses the identity associated with a data request as an input to Ubiq policy evaluation.

Identity information may come from:

Okta
Microsoft Entra ID
Application-provided identity
Service or workload identity
API credentials
Ubiq API access credentials

Human and non-human identities can be mapped to Ubiq groups and dataset policies.

When a protected data operation occurs, Ubiq evaluates the requester’s identity, group membership, dataset policy, requested operation, and available runtime context to determine the appropriate data output or protection operation.

Based on policy, different identities can receive different representations of the same data, including cleartext, masked, tokenized, encrypted, or otherwise protected values.

The identity source remains authoritative for identity and group membership. Ubiq uses that context to enforce policies associated with datasets governed by Ubiq.

The identity provider does not need to be called inline for every runtime data operation, and Ubiq does not need to sit inline between the requester and the application, database, or data platform. The exact identity flow depends on the integration and customer architecture.

Deployment Architecture

Ubiq uses a hybrid SaaS architecture with a Ubiq control plane and locally deployed integrations.

Ubiq Control Plane

The control plane provides:

Dataset and policy configuration
Identity and group mappings
Sensitive Data Discovery configuration and results
Access Intelligence graph, authorization relationships, and effective-access analysis
Key orchestration and management
Event and security history

Customer Environment

The customer environment contains:

Locally installed Ubiq libraries, connectors, or integrations
Local cryptographic and data-transformation operations
Authorized runtime key material and cached configuration
Customer-controlled HSM or KMS infrastructure where configured

Ubiq does not require sensitive data to be moved into a centralized vault or routed through an external proxy for runtime protection.

Ubiq can provide managed, HSM-backed key infrastructure or support customer-controlled HSM and KMS configurations where applicable.

Deployment requirements vary by integration point, protection method, and whether data is protected in storage or when accessed.

Data Protection Methods

Ubiq supports multiple protection methods through a common dataset and policy model.

Tokenization and Format-Preserving Encryption

Tokenization and format-preserving encryption replace sensitive values with protected values that retain the format required by the application or data system.

These methods can be used when applications or workflows do not require access to the original value and can reduce application, schema, and workflow changes for supported use cases.

Masking

Masking returns a modified representation of a sensitive value.

Policies can apply full or partial masking based on the identity, dataset, and use case.

Encryption

Ubiq supports standard encryption for data that does not need to retain its original format.

Encryption and decryption are performed locally through the installed integration.

Key Management

Ubiq manages key use through dataset policies and locally deployed integrations.

Key-management options include:

Ubiq-managed HSM-backed key infrastructure
Customer-controlled cloud KMS
Customer-controlled HSM
Customer-managed key configurations supported by the integration

Cryptographic operations are performed locally within the customer environment.

The exact handling of master keys, wrapped keys, derived keys, and cached key material depends on the selected architecture and integration.

Audit and Security Visibility

Ubiq records runtime data-protection activity for audit and security analysis.

Recorded information may include:

Event ID
Timestamp
Human or non-human identity
Identity group
Dataset and field
Requested operation

Events can be reviewed through Ubiq and exported to supported security and monitoring systems.

Runtime protection activity can be reviewed alongside identity, dataset, policy, and access context for audit and security analysis.

Data Coverage and Limitations

Sensitive Data Discovery and Runtime Data Protection support different data sources and data types.

Sensitive Data Discovery may scan supported structured, semi-structured, and unstructured data sources.

Runtime Data Protection is primarily intended for structured and semi-structured data accessed through applications, databases, data warehouses, APIs, analytics tools, and automated workflows.

Ubiq is not intended to replace endpoint document rights management or productivity-file protection for Office documents, PDFs, images, laptops, or collaboration platforms.

Refer to the documentation for each connector or integration for supported capabilities, deployment requirements, and limitations.