Data mapping and RoPA
See where one programme keeps personal data.
An operator goes through the systems you connect, lists every field and file that holds personal data, says how it decided, and drafts your records of processing. Your DPO signs off before anything is filed.
ISO 27001 · GDPR · Every run auditable
Salesforce · Contact, Case2 objects read · 11 personal-data fields
- Case.DescriptionFree text, health mentioned · CustomersRead 50 sample cases; some describe allergies
Health data, a special category, in a free-text field. Question for the CRM owner: should agents record this at all?
4 systems · 37 read · 44 personal-data columns and fields · 4 files · 3 questions
Upload register_IV-0412.xlsx to SharePoint › Privacy › RoPA
Each question goes out in Slack only after a yes.Enterprises running operators on Alomana
- up to 90%less manual governance work
- 70%faster compliance mapping and audit response
- 10–30%storage savings from clearing redundant and obsolete data
What the operator does with each system
The slow part of a data map, done as reviewed work.
- Tables and columnsLists every column in Snowflake or PostgreSQL and checks sample values
- CRM fieldsGoes through Salesforce and HubSpot objects and the fields that hold people's data
- Folders and filesOpens documents in SharePoint and Google Drive and notes who and what they describe
- Special categoriesFlags health, biometric and other special-category data, including in free text
- Records of processingDrafts Article 30 entries and DPIA screenings from what it found
- Questions for ownersDrafts what to ask each data owner and sends it only after a yes
How the operator builds a data map
- 1
Connect
The systems in scope, your categories, where the register goes.
- 2
Inventory and draft
Reads each system, writes the register and the RoPA drafts.
- 3
Review and sign
Your DPO says yes. It files the register and logs it.
It reads what you connect.
The operator works system by system, inside the systems you choose. It reports what it read and what it skipped.
Access reviews and labels stay with your security tools.
- Snowflake and PostgreSQL: every table, column and sample
- Salesforce and HubSpot: objects and fields
- SharePoint and Google Drive: folders, files and their text
- Other systems through a remote MCP server
Nothing is filed or sent without a yes.
- Uploads, messages and tickets wait for a person's yes
- A declined action is not retried
- Every run logged: input, output, tools, user
Measured on
- Hours per system inventoried
- Fields and files documented
- Owner questions closed
- RoPA entries signed off
Works with
- Snowflake
- PostgreSQL
- Salesforce
- HubSpot
- SharePoint
- Google Drive
- Slack
- Jira
- Other systems via MCP
Trusted for
- ISO 27001
- GDPR
- Never trains on your data
- Single-tenant for enterprise
A custom operator typically goes live in up to 4 weeks.
Questions
What is a data mapping operator?
An autonomous agent that builds your personal-data inventory. It goes through the systems you connect, lists every field and file that holds personal data, says how it decided, drafts your records of processing, and waits for your DPO's approval before anything is filed or sent.
Is it a DSPM or a scanner for our whole estate?
No. It reads the systems you connect, one by one, and shows what it read. It does not crawl every store or change who can access what. Security teams keep their posture and access tools; the operator writes the inventory and the records the privacy team needs.
How does it decide what is personal data?
From column and field names, sample values and the text of documents. Every row in the register says which of these it used, and anything uncertain is listed as a question for a person. Your team reviews the register before it is filed.
Which systems does it work with?
Snowflake, PostgreSQL, Salesforce, HubSpot, SharePoint and Google Drive, with Slack and Jira for questions to data owners. Alomana has 20+ connectors, activated per deployment; other systems connect through a remote MCP server.
Does it write our records of processing?
It drafts them. For each processing activity it proposes the purpose, data categories, data subjects, systems, lawful basis and retention, marks what still needs an answer, and drafts a DPIA screening. Your DPO reviews and signs; the operator does not certify compliance.
Is our data private?
Alomana is ISO 27001 certified and GDPR-compliant, and your data is never used to train AI models. Enterprise deployments run single-tenant, in a dedicated instance.
Bring one system.
Talk it over with sales: what the operator needs from your systems, and how it goes live.
Alomana is a secure enterprise AI platform where autonomous agents, called operators, run business processes end to end. Every run is fully auditable.