Does Goava itself store personal data?

Goava manages metadata, not the data itself: asset names, schemas, classifications, ownership, lineage, and quality metrics. It does not copy your customers' records into the platform. You deploy it on your own servers or in a Saudi cloud region, and no catalog data leaves your environment by default, so even your metadata remains under your control.

How is PII classification applied across assets?

Through classifications and tags. Apply PII tags to the datasets, columns, and API endpoints that hold personal data, or link them to a glossary term so every asset the term is applied to carries them. Tags are not copied down from a database or schema, or along lineage, so each asset is classified where it holds personal data. The API exposure view then flags endpoints tagged public, personal or financial.

Can Goava evidence our PDPL compliance?

Goava is not a certification, and no tool alone makes you compliant. What it does is make compliance demonstrable: KPIs track how much of your estate is owned and described, daily charts show tier and PII coverage, lineage shows exactly where personal data flows, and RBAC, SSO, and activity feeds keep the record audit-friendly. Your Data Management Office sets the policy; Goava supports the evidence.

PDPL Readiness

PDPL is fully enforced. Know where personal data lives.

The Personal Data Protection Law has been in full force since September 2024, and SDAIA is actively supervising compliance. The first question every Data Management Office must be able to answer: where does personal data live, who owns it, and where does it flow? Goava gives you a living, classified inventory of personal data across databases, dashboards, pipelines — and the APIs that expose it.

Request a demo Explore NDMO alignment

Discover & classify

Find personal data everywhere it hides

You cannot protect data you cannot find. Goava connects to more than 80 sources and builds a unified, searchable catalog of tables, dashboards, pipelines, topics, and APIs — then lets you classify personal data on the datasets, columns, and API endpoints that hold it.

Connect 80+ native sources — Snowflake, Oracle, SQL Server, PostgreSQL, MongoDB, Power BI, and more — into one searchable catalog.
Apply PII classifications and tags to datasets, columns, and API endpoints, with glossary terms carrying their linked tags.
Assign owners so every personal-data asset has someone accountable for it.
Organize personal data with domains and a business glossary aligned with your PDPL records of processing.

Explore the data catalog

The API blind spot

Which public endpoints expose personal data?

Most governance programs stop at databases and dashboards — but personal data also leaves your organization through APIs. Goava catalogs your API endpoints from their OpenAPI specifications and lets you link each one to the data behind it.

API endpoints cataloged from OpenAPI specifications; gateway connectors for Kong, Amazon API Gateway, Azure API Management, Google Cloud API Gateway and NGINX in preview.
Link each endpoint to the tables behind it, down to the column.
Tag endpoints with the same PII classifications you apply to your tables and columns.
An API exposure view that flags endpoints tagged public, personal or financial.

Explore API governance

Evidence for the regulator

Show your work — coverage, ownership, and lineage

When the questions come, assertions are not enough. Goava turns day-to-day governance into reviewable evidence: who owns each personal-data asset, how it is classified, and exactly where it flows.

Ownership and description coverage tracked against KPI targets, with tier and PII coverage charted daily.
End-to-end, column-level lineage of personal data flows — from source systems to dashboards and APIs.
Data quality profiling and tests, with incident management when a check on personal data fails.
Audit-friendly foundations: RBAC, SSO (OIDC / SAML 2.0 / LDAP), and activity feeds on every change.

Explore governance features

Four capabilities at the core of PDPL readiness

From discovery to evidence — one platform, natively bilingual, deployed on-premises or in cloud inside Saudi Arabia.

PII classification
Hierarchical PII classifications applied as tags on datasets, columns and API endpoints, with glossary terms carrying their linked tags.
Lineage of personal data
End-to-end, column-level lineage with a visual editor and a lineage API — see every hop personal data takes through your systems.
API exposure
An API exposure view that flags endpoints tagged public, personal or financial.
Coverage KPIs
Ownership and description coverage tracked against KPI targets, with tier and PII coverage charted daily — measure progress, not intentions.

PDPL readiness — common questions

See your personal-data landscape in one place

Book a demo and watch Goava map personal data across your databases, dashboards, pipelines, and APIs — in Arabic and English.

Request a demo