Inventory and Data Flow

The inventory is the record of what personal data you hold, where it lives, and how it moves. It brings together the systems you scan or register by hand, the data points inside them, the sources you collect data from, the people that data belongs to, the activities you process it for, and the vendors you share it with. Everything else in data discovery, including your RoPA reports and purpose registry, is built from these records.

Open Data Inventory > Inventory. Five tabs sit across the top: Data System, Data Collection Source, Data Subjects, Processing Activities, and Vendors.

Data System

The Data System tab lists every system in your inventory, whether it arrived through a scan or was added by hand. Columns show Name, Type, Integration (the scan integration it came from, or blank for a manual system), Sends Data To (chips for each system it shares data with, plus Add Connection), and Created At.

Click Add New to create a system manually: give it a Name and a Type (PostgreSQL, MySQL, MongoDB, DynamoDB, S3, or GCS), then Save. A manually created system has no integration and no automatic scan; you build out its schema yourself.

Click a system to open Data System Details, with these tabs:

• Overview: Title, Description, Owner, Country, Type, Integration, Created At, and Modified At. If the system has an integration, a Jump to Integrations link opens the underlying integration record.
• Browse: the system's schema as a tree, for example database, schema, and table for a SQL system, or database and collection for MongoDB, with the data points found in each node.
• Data Points: the data points discovered or added for this system, described below.
• Scan Diagnostics: only shown for systems that have an integration; scan-related detail for that system.
• Metadata: the custom attributes attached to this data system, using the definitions described under Metadata Definitions.

Data points and classification review

The Data Points tab lists every data point classified in the system: a column, field, attribute, or object key, depending on the system type. Each row shows Location (its table or collection path), Classification (category and data object, color-coded by risk), Regulations (its GDPR, DPDPA, and CCPA/CPRA mappings where known), Metadata, Status, Reviewed By, Reviewed At, Review Note, and Created At. Use Columns to show or hide any of these, and Filters to narrow by table name, classification, or status.

Every classification carries one of three statuses:

Click the pencil icon on a row's status chip to open the review dialog. Choose a Status and add an optional Notes field, then Update Status. The row then shows who reviewed it and when.

Click Add Data Point to register a data point manually, for systems with no scan or for objects a scan missed. Pick the schema location by cascading through the system's existing tree (database, schema, table, column for SQL; database, collection, field for MongoDB; table, attribute for DynamoDB; bucket, folder for object storage), or use Add Table first to create the containing table, collection, or bucket as a manual schema node before adding data points inside it.

Each data point's Metadata column shows its attached custom attributes as chips; click the + button to open a drawer and add, edit, or remove them.

Data Collection Source

Lists where you collect data from: forms, APIs, imports, and similar sources that feed into your systems. Columns are Name, Description, Brands, Metadata, Status, and Actions. Filter by Status (Active or Archived) and search by name.

Click Add Data Collection Source to open the drawer: Name (required), Description (optional), and Brands (optional, multi-select). Save with Add. Edit an existing source with the pencil icon, which reopens the same fields. Archive an active source from its row action; archiving does not delete it, just removes it from active use.

Click a row to open Data Collection Source Details, showing its name, description, brands, status, and metadata attributes.

Data Subjects

Lists the categories of individuals your data covers, such as customers or employees. The list, add/edit drawer, and detail page follow the same pattern as Data Collection Source: Name, Description, Brands, Metadata, and Status, with Add Data Subject, edit, and archive actions.

Processing Activities

Lists your processing activities, the record required for GDPR Article 30 and DPDPA obligations. The list shows Name, Description, Brands, Metadata, and Status, with Add Processing Activity, edit, and archive actions identical in shape to the other tabs.

A processing activity's linkage to data subjects, vendors, and collection sources is expressed through its metadata attributes rather than dedicated form fields: attributes attached to the activity record which subjects, vendors, and data points it covers, and this is what a RoPA report reads when it aggregates the activity's data.

Vendors

Lists third parties you share data with. Columns are Name, Description, Website, Metadata, and Status. Click Add Vendor to fill in Name, Description, Website, and any number of Contacts, each with a Type (Primary, Privacy, Security, Incident, Legal, Billing, Technical, or Other), Name, Email, Title, and Phone. Add or remove contacts with Add Contact and the delete icon next to each row.

Click a vendor to view its details, including its website as a clickable link and its contacts. Edit and archive work the same way as the other tabs.

Data Flow

Open Data Inventory > Data Flow to see how data moves between your systems. It has three views: System Flow, Data Point Linkage, and Cross Border Transfer.

System Flow renders your data systems as nodes on a graph, connected by the sharing relationships you have defined between them. Filter the graph by data category, purpose of processing, legal basis, country, system type, relationship type, or cross-border only, and trace a specific data point across the graph by searching for it. Select a node or connecting edge to open its details in a side panel.

Data Point Linkage shows the same graph focused on which individual data points map from a source system into a destination system along a given sharing connection.

Cross Border Transfer plots transfers between countries on a world map, drawing a line between the source and destination country for each sharing relationship that crosses a border, alongside filters for data category, purpose, geography, and system type, and a summary list of the underlying transfers.

Adding a data sharing connection

From the Data System tab, click Add Connection on a system's row to open the connection dialog. Choose a destination system from your other data systems, then select which of the source system's data points to include, grouped by table or collection for easier selection. Save to create the connection; it then appears as a chip under Sends Data To on both the list and the System Flow graph.

Click an existing connection chip to edit it: change its destination, adjust which data points are mapped, or delete the connection entirely.

Every sharing connection carries a status:

Metadata Definitions

Metadata Definitions is where you define the custom attributes used across every tab in the inventory. Open it from Data Inventory > Metadata Definitions (also reachable from the Metadata tab on any data system or record).

Click Add Metadata to define a new attribute:

• Key: lowercase letters, numbers, underscores, and dots only, up to 100 characters, structured as one to three dot-separated segments (for example country, general.country, or general.region.country). The key cannot be changed after creation.
• Label: up to 100 characters; what reviewers see on records.
• Description: optional.
• Value Type: one of Text, Number, Yes / No, Date, Single Choice, or Multiple Choice. Single Choice and Multiple Choice require at least one Allowed Value, which you add one at a time. The value type cannot be changed after creation.
• Supported Targets: at least one of Data System, Vendor, Processing Activity, Data Point, Integration, Data Collection Source, or Data Subjects. This controls which record types can carry the attribute.

Save to create it, or edit an existing definition to change its label, description, allowed values, or supported targets. The list shows Key, Label, Value Type, Supported Targets, and Status. Toggle a definition between active and archived from its row action; archiving removes it from use on new records without deleting values already saved on existing ones.

Once a definition exists for a given target type, it appears in that record's Metadata drawer or tab, where you set its value against individual data systems, vendors, processing activities, data points, integrations, collection sources, or data subjects. Creating, editing, and archiving metadata definitions requires the same Data Inventory management permissions as the rest of this module.

From inventory to RoPA and the purpose registry

The relationships you build here, data points classified inside a system, sharing connections between systems, and the subjects, vendors, and collection sources linked to a processing activity through its metadata, are what a RoPA report pulls together when you generate one. See Reports for how a Record of Processing Activities is assembled from this inventory.

The same processing activities, data subjects, and vendors feed the purpose registry maintained under this module, and the data systems and points you classify here are what an assessment's inventory linkage refers back to. See Assessments for how assessments connect to inventory records.