Warehouse visibility
Map warehouse tables and columns so teams can see where identifiers, contact fields, and derived customer records appear.
Find where customer data lives in the warehouse.
Chameleon helps data and compliance teams maintain a registry of customer data by mapping tables and columns across BigQuery or Snowflake, connecting policy context, and showing where deletion work needs to reach.
Registry context
Keep PII location, owner, deletion strategy, and policy status together instead of spreading privacy context across tickets and docs.
Audit readiness
Give compliance reviewers a concrete registry surface before a deletion request or privacy audit becomes urgent.
You can't protect data you can't find.
Personal data rarely stays where it was first collected. It gets copied into staging tables, reshaped by transformation jobs, joined into analytics marts, exported to dashboards, and synced into SaaS tools. Every hop creates another place where a customer's email, phone number, or account identifier can quietly live — and most of those places never make it into a compliance inventory.
When a deletion request or a regulator's question arrives, the first task is always the hardest: enumerate every location that holds that person's data. Teams that rely on tribal knowledge and out-of-date spreadsheets consistently miss copies. PII discovery is the practice of building — and continuously maintaining — an accurate map of where personal data actually lives.
A live registry, not a stale spreadsheet.
Chameleon maps your warehouse tables and columns — BigQuery or Snowflake — and records which fields hold personal data, who owns each resource, which deletion strategy applies, and how the data flows through dbt transformations. Because the registry is generated from the warehouse itself, it stays current as tables change instead of drifting the moment someone ships a new model.
That registry becomes the single source of truth for every downstream privacy workflow: ghost-data review, policy enforcement, and deletion proof all read from the same map. Discovery stops being a quarterly fire drill and becomes a property of the system.
01 / Connect
Start from your warehouse assets (BigQuery or Snowflake) and dbt context that describe the tables and models in scope.
02 / Map
Build a registry of tables, columns, PII classifications, owners, and deletion strategies.
03 / Review
Surface policy status and fields that require registration, cleanup, or manual review.
04 / Prove
Use the registry as the source of truth when deletion work needs evidence across connected systems.
resource: chameleon_dev.stg_users
columns: user_id, email, phone
strategy: crypto_shred
status: registry_tracked
columns: user_id, email, phone
strategy: crypto_shred
status: registry_tracked
Common questions
What is PII discovery?
PII discovery is the process of scanning your systems to find where personally identifiable information lives — which tables, columns, files, and connected tools contain data that can identify a person. The output is an inventory or registry that privacy and compliance teams rely on when handling deletion requests, audits, and data subject access requests.
How do you find PII in a data warehouse like BigQuery or Snowflake?
You combine schema inspection (column names and types), pattern matching on sample data (email, phone, and identifier formats), and lineage from tools like dbt to see how personal data propagates into derived tables. Chameleon does this automatically and records each finding in a live registry with an owner and a deletion strategy.
Isn't a data catalog enough for PII discovery?
A catalog tells you what tables exist; it rarely tells you which specific columns hold personal data, which deletion strategy applies, or whether an undeclared field just appeared. PII discovery adds the privacy-specific classification and the continuous scanning that a general-purpose catalog does not.
Start with the fundamentals: what counts as personally identifiable information, and why the definition is broader than most teams assume.
The undeclared PII that discovery is designed to catch — how it accumulates and why it is an audit risk.
Once you know where data lives, see how Chameleon turns that map into verifiable evidence of erasure.