Data Access
Exactly what ztrust accesses — and what it never touches.
When you connect a data source to ztrust, you are giving us read access to scan for personal data risk. This page documents every permission we request, what we read, what we ignore, and how to revoke access at any time.
How it works
Three principles that govern every connection
Read-only, always
ztrust never writes to, modifies, or deletes data in any connected system. We have no INSERT, UPDATE, DELETE, or DROP permissions. If a credential includes write access, our scanner ignores it.
Metadata-first
We default to reading schema and structural metadata — table names, column names, sharing settings. We do not read actual record values unless you explicitly enable content scanning for a specific source.
You stay in control
You can revoke access at any time from your systems directly. Revoking the database user or the OAuth token immediately stops all scanning. No need to contact us first.
Permission manifest
What we access — per integration
Every integration ztrust supports is documented below with the exact permissions requested and what we read versus what we ignore.
PostgreSQL
Read-only database user
Exact SQL grants (copy and verify before running)
GRANT CONNECT ON DATABASE <yourdb> TO ztrust_scanner; GRANT USAGE ON SCHEMA public TO ztrust_scanner; GRANT SELECT ON ALL TABLES IN SCHEMA public TO ztrust_scanner;
What we read
- Table names and column names (pg_catalog)
- Column data types and constraints
- Database role names and grants
- Schema structure only — no row data by default
What we never read
- Actual row values (customer records, employee data)
- Passwords or secrets stored in the database
- Data outside the schema you explicitly grant
Content scan note: If you enable content scanning (off by default), ztrust samples up to 100 rows from flagged columns to confirm field-level patterns (e.g., Aadhaar format). Sampled values are used for detection only and are not stored.
How to revoke access
Run: DROP USER ztrust_scanner; — access stops immediately.
Google Drive
OAuth 2.0 — read-only scopes
OAuth scopes requested
drive.metadata.readonly + drive.readonly (content scan only)What we read
- File names and folder paths
- File owner (email address)
- Sharing permissions: who has access, whether link is public
- Last modified date
What we never read
- File contents — unless content scan is explicitly enabled
- Google Workspace emails or calendar data
- Files outside the Drive you connect
Content scan note: Content scan reads file text to detect personal data field patterns. It is off by default and must be explicitly enabled per Drive connection.
How to revoke access
Go to myaccount.google.com → Security → Third-party apps → remove ztrust. Access stops immediately.
CSV / Excel upload
Manual upload — you control what is sent
What we read
- Column headers and data types from the file you upload
- Sample row values if content scan is enabled
What we never read
- Anything you have not explicitly uploaded
How to revoke access
Contact support@ztrust.ai to delete an uploaded file. We will confirm deletion within 48 hours.
Data retention
What ztrust stores on our servers
ztrust stores findings and metadata — not records. Here is exactly what lands in our database when you run a scan.
We store
- Schema metadata: table names, column names, data types
- Risk findings: the detection result (e.g., "aadhaar_number column detected, unprotected")
- Evidence timestamps: when a scan ran, what it found
- Access actor names: DB role names, Drive file owner emails
We never store
- Actual records: no employee names, no customer data, no health or financial records
- Row values from your database (unless content scan is enabled — sampled only, not retained)
- File contents from Drive (unless content scan is enabled — sampled only, not retained)
Verify
You can audit our access yourself
Don't take our word for it. Every permission ztrust requests can be independently verified before you grant it.
PostgreSQL — check grants before connecting
We provide the exact GRANT statements. Run them yourself, review what you are granting, then confirm. You can also run SELECT * FROM information_schema.role_table_grants WHERE grantee = 'ztrust_scanner' to verify at any time.
Google Drive — review OAuth scopes before authorizing
The Google OAuth consent screen shows every scope ztrust requests before you approve. If you see anything beyond drive.metadata.readonly (and drive.readonly for content scan), do not authorize.
Any integration — revoke and verify access stops
Revoke access, then attempt a manual scan from the ztrust dashboard. It should fail with a connection error within seconds — confirming that ztrust has no cached or retained access path.
Questions
Security or access questions
If something on this page is unclear, or if you want to discuss a custom access configuration before connecting a source, reach out.