Data Marketplaces | VestraData

Regulatory context

The frameworks your auditors will cite.

GDPR Controller Obligations

As the publisher, you carry controller liability for personal data in published datasets, regardless of what your suppliers told you.

ICO Data Sharing Guidance

PII in shared datasets creates liability for the sharing party. Technical controls at the point of publication are the appropriate measure.

Sector-Specific Obligations

Healthcare, financial, and legal datasets carry additional vertical-specific obligations on top of GDPR.

In practice

What Data Marketplaces teams actually use it for.

01Automated PII scanning on dataset ingest before publicationEvery dataset arriving at your platform triggers a scan before it enters the publish queue. Field-level PII findings surfaced automatically. Clean datasets pass through. Findings queued for review. No manual inspection for the majority of ingest.

02Multi-tenant isolation with SDK-first integrationThe VestraData SDK integrates directly into your marketplace ingestion pipeline. Each publisher tenant gets isolated scanning results and audit records. Multi-tenant architecture from the ground up.

03Event-driven scanning triggered on file arrivalWatch an S3 bucket, SFTP drop, or API endpoint. When a file arrives, scanning starts automatically. Governed clean copies go to the publish queue. Raw files with findings never reach customers.

04API-level integration with existing marketplace infrastructureREST API and OpenAPI spec. Python, Node.js, Java, and .NET clients. Asynchronous scanning with webhook callbacks. Fits inside your existing ingestion pipeline without architectural change.

Platform capabilities

How VestraData maps to this environment.

Event-driven scanning

Scanning triggered on S3 event, SFTP arrival, or API upload. No polling. Webhook callbacks on completion. Designed for high-throughput ingestion pipelines.

Multi-tenant isolation

Each publisher tenant gets isolated scanning context, results, and audit records. No cross-contamination of findings or audit data.

SDK-first integration

Python, Node.js, Java, and .NET SDK clients. OpenAPI spec for custom integration. Embed the detection engine directly inside your pipeline if needed.

Zero-shot PII detection

GLiNER v2 handles any sector-specific entity type without retraining. Health identifiers, financial references, legal codes: all from the same engine.

Governed clean copy pipeline

Raw datasets with PII are never published. Governed clean copies generated automatically and placed in the publish queue. Full audit trail per dataset.

OpenAPI spec

Complete REST API with OpenAPI 3.1 spec. Generates typed clients in any language. Integrates with your existing API gateway and authentication layer.

Companion tool · VestraShield

Your team uses AI to evaluate the same data you publish.

VestraShield intercepts every AI-assisted dataset review, analysis, and enrichment step. PII in the datasets your team is working with doesn't reach any LLM endpoint without being governed first.

AI-assisted evaluation interceptEvery prompt your analysts send to ChatGPT, Claude, Gemini, or Copilot while evaluating or enriching datasets is intercepted before it leaves your environment.
Custom dataset entity typesDataset-specific identifiers, proprietary field names, and sector-specific codes caught by zero-shot GLiNER. No model retraining required.
Policy engine for analyst teamsDifferent intercept rules for data engineers, analysts, and reviewers. Transform sensitive content, hard-block restricted identifiers, or audit-only for low-risk entities.
Session audit trailEvery AI-assisted analysis session logged with entity inventory. Attributable to user and tool. Hash-chained and tamper-evident.

Every dataset you publish carries your reputation.