Getting started with Formal

​

Introduction

Data-driven organizations use Formal to streamline data security, compliance, data quality management, infrastructure access, and governance in one platform. In such organizations, teams often:

• Need real-time access to their data to make business decisions.
• Can lose track of whether or not their data usage is secure and/or fully compliant with all the relevant regulations.

Formal helps teams attain both efficient data access and powerful data governance, without any need to trade one for the other.

​

Four pillars

Formal is built around four core pillars that drive its functionality and value proposition:

​

Understand

Formal is an observability platform that encourages teams to develop a clear understanding of where sensitive data is located and how data flows within the organization.

Two key categories at Formal provide enhanced data consumption insights across the organization:

1. Data discovery

   • Automatic PII/PHI detection: Identify sensitive data and apply standardized classification and tags across cloud data platforms.
   • Custom labels: Tailor tags to match your organization’s specific needs.
   • Structured and semi-structured data: Fully understand your data whether it lives in relational or non-relational databases.

2. Database Activity Monitoring

   • Audit logs: Log every single request made to your data stores. Export the logs to your favorite platform including Datadog, Splunk and AWS S3.
   • Data flows: Gain visibility into sensitive data access and usage metrics, identifying insiders’ activities.
   • End-user identity propagation: Formal gives security and data teams end-to-end visibility on data consumption at the organization. By extracting user identity information from BI and tools’ requests, Formal ensures accurate user identification.
   • Unusual activity notifications: Receive alerts for suspicious events or activities.

​

Align

Once teams have a comprehensive understanding of their data environment and security posture, they can leverage Formal’s collaborative features to align all stakeholders and establish a cohesive data security strategy.

Formal’s collaborative features include:

• No-code and NLP policy editor: Enforce policies effortlessly, catering to legal and GRC teams without requiring extensive technical expertise. Leverage Formal NLP features to automatically translate policy into code (Rego).
• Self-service access request: Streamline access requests, approvals, and provisioning, reducing the need for support tickets.
• Slack integration: Get notified when a policy gets triggered, manage approval workflow directly from Slack.
• Team workspace: Collaborate and leave comments in the policy editor as well as the data inventory. Assign tickets thanks to our JIRA and Linear integration.
• Terraform provider: Save engineering time and facilitate onboarding for your SRE team with our Terraform provider.
• Formal desktop CLI: Streamline access to your databases by using Formal desktop CLI, unifying the workflow to your databases for your entire organization with a set of credentials per employee.

​

Control

Once controls have been agreed upon, teams can effortlessly apply them across their entire data stack with just one click.

Formal offers a comprehensive suite of tools to help you maintain control over your data:

• SSO-powered centralized Access Management: Grant users a single identity to access every data store, seamlessly syncing users and groups with Formal’s native SSO integration.
• Open Policy Agent Powered Policy Engine: Decouple the enforcement of your policies, from the location of your data to the context in which your data is being consumed. Write policies that work across your entire data stack. Formal policies are written in Rego and can enforce masking, filtering, rate-limiting, blocking, and decrypting.
• Universal Dynamic Data Masking, Filtering, Decrypting and Blocking: Formal’s capabilities let you anonymize data based on context, regardless of the datastore, and enjoy simplified maintenance.
• Field encryption: Utilizing AES-256 encryption, Formal can encrypt any data that is uploaded and ingested before it reaches your data store. The same piece of data can then be decrypted anywhere in your stack. For example, you can upload a CSV file to AWS S3, encrypt the email column before it reaches S3, have an ETL copy the data into Snowflake, and then have a Formal policy decrypting the data at query time for the right user group.

​

Prove

Formal lets you effortlessly demonstrate your organization’s robust data security posture and ensure compliant data use thanks to the generation of automated security reports.

With a range of powerful features, Formal equips you to effectively showcase your data security posture:

• Audit Logs: Keep track of requests, data access, and policy changes across your entire data stack within a single platform. Archive audit logs for up to 10 years, ensuring long-term availability and compliance.
• Compliance software integrations: Seamlessly collaborate with your compliance automation platform thanks to our integrations with Vanta and Secureframe.
• Security reports: Access real-time, shareable reports on your security posture, allowing you to present your organization’s data security to customers and prospects.
• AI-Guided remediations: Leverage Formal’s NLP policy editor to implement policies that align with your objectives, guiding you towards the best compliance posture.

​

Get started

​

Using this documentation

We’ve prepared these materials to help engineering, security, and data teams get started in 10 minutes with Formal. The different sections are here to guide you every step of the way and make your onboarding as smooth as possible.

If you have any questions or if anything appears unclear, don’t hesitate to reach out to Formal’s support via email at support@joinformal.com.