Case Study
At a glance
The data landscape
Profile
Data observability platform
Monitors data inside customers' own warehouses
A security team of two
Environment
Snowflake
AWS
Production and dev
Dedicated and EU-only customer environments
The challenge
Customers wanted proof their data stayed put
Customers asked for proof. As the business grew, customers asked the security team to prove their source data had not moved into the platform, where only metadata should live.
Proving a negative by hand. The team combined VPN traffic and S3 access logs and reviewed them once every 30 days.
Ten hours a customer. Each data residency request took about ten hours of work, for a security team of two and a half people.
“How do we know customer data stays in the boundaries where it needs to be?”
The platform's CISO
“Right now, our alerts are nuts, and it's only [two of us].”
A security engineer at the platform
Why Bedrock Data
A daily map of where data sits
Outposts in the platform's own AWS
Bedrock Data scans Snowflake and AWS in place, in production and in dev.
A daily data map
Every data store and what it holds, updated every day.
Access by identity
Users, roles and service accounts, tied to each data store.
Evidence customers can see
The security team shows customers the map when they ask where their data is.
Coverage that grows with the platform
New dedicated and EU-only environments come into scope as they launch.
Context beside existing tools
Bedrock Data adds what data is involved to the team's cloud security tooling.
Results
Daily evidence for every customer who asks
A check that runs every day. A review that ran once every 30 days now runs daily.
Same-day answers. When a customer asks where their data lives, the answer comes from that day's map.
Confidence customers can see. The team has put the map in front of customers as evidence of where their data sits.
Renewed and expanded. The platform renewed and expanded with Bedrock Data in 2025.
The map covers production and dev in one view, so a two-person team can answer data residency questions without a monthly manual review.
The vision
Protecting data in use next
“Bedrock provides a picture of our data we just can't get anywhere else. I can tell my customers in a few hours what I need to do to reduce risk.”
The platform's CISO
What's next
Where this is heading
Protecting data in place came first. Next is protecting data in use, as the team builds agents that pull Bedrock context into alert triage.
