Federated SQL with governance
compiled into the plan
Dataglot is a Rust-native federated query engine. Point it at the databases you already run, query them all through one PostgreSQL endpoint — and let column masks and row filters be enforced inside the query plan itself, not bolted on afterwards.
docker pull ghcr.io/dataglotai/dataglot
-- users in Postgres, orders in another Postgres, segments in MySQL.
-- One JOIN. The masking policy on users.email rides along.
SELECT u.email, s.segment, o.amount
FROM users u
JOIN pg_orders.public.orders o ON u.id = o.user_id
JOIN mysql_demo.demo.customer_segments s ON u.id = s.user_id
ORDER BY o.amount DESC;
email | segment | amount
-----------------+----------+--------
***@example.com | beta | 199.00
***@example.com | standard | 199.00
***@example.com | beta | 19.50
(4 rows — masked at plan time; the raw email never left the source)The execution layer of your governance — built for the AI era, made for every data access
Claude
MCP agents
LangChain
RAG pipelines
Power BI
Tableau
Grafana
Notebooks
psql · apps
PostgreSQL
MySQL
Snowflake
Oracle
Iceberg
Object storage
The one line that cannot move
Most engines enforce policy by rewriting SQL after parsing, or filtering results after execution. Dataglot compiles masks and row filters into the physical plan as typed predicates pushed into the scan — a masked column is never fetched from storage, on any code path, for any client.
- Column masks and row filters as typed plan expressions, not string rewrites
- Per-identity and per-organization policies driven by typed tags
- Column-level OpenLineage emitted on every query; DataHub integration built in
- Policies managed over plain SQL:
CREATE MASK,CREATE ROW FILTER,GRANT
-- policy is DDL, not a config file
CREATE MASK email_mask ON COLUMNS TAGGED 'pii.email'
AS '***@' || split_part(email, '@', 2);
CREATE ROW FILTER region_scope ON orders
FOR ROLE analyst USING region = current_org();
-- and enforcement is visible in the plan itself
EXPLAIN SELECT email FROM users;
└─ DataglotPolicyEnforcer: mask(email) pushed into scanPushdown you can see
Dataglot ships whole aggregations to your sources as native SQL — and
EXPLAIN FEDERATION shows you exactly what went where. No black box, no
"trust us" query planner.
- PostgreSQL, MySQL, Oracle, Snowflake, S3/Parquet, Apache Iceberg, SAP/OData
- Add sources at runtime with
CREATE CATALOG— no restart, no config edit - One binary that scales from your laptop to a distributed cluster
- No JVM anywhere — small footprint, fast starts, simple operations
EXPLAIN FEDERATION
SELECT user_id, SUM(amount) AS total_amount
FROM pg_orders.public.orders
GROUP BY user_id ORDER BY total_amount DESC;
VirtualExecutionPlan name=postgres://…@postgres-orders:5432/demo
base_sql=SELECT "user_id", sum("amount") AS "total_amount"
FROM "public"."orders"
GROUP BY "user_id" ORDER BY "total_amount" DESC
-- the whole aggregation shipped to the source, not just the scanBuilt for the data you're not allowed to move
Dataglot is the federated SQL engine for regulated environments — banking, insurance, healthcare. It queries the sources your workloads actually run on, where copying the data out is not an option and "we filter it in the app" is not an answer.
Structural enforcement
Masks and filters live in the plan, so there is no code path that returns ungoverned data — not a best-effort rewrite in front of the engine.
Your data stays put
Query Oracle, Snowflake, Postgres, MySQL, Iceberg and object storage in place. Federation pushdown does the heavy lifting at the source.
Rust-native, JVM-free
A single static binary that starts in milliseconds and runs the CLI and REPL fully in-process — no cluster, no warm-up, no fleet of sidecars to get started.
SQL-native control plane
CREATE CATALOG, CREATE USER, GRANT, CREATE MASK — the whole engine is administered over the same wire protocol you query with.
Enterprise auth, day one
SCRAM-SHA-256, JWT, LDAP/Active Directory groups, TLS ingress, per-identity rate limits — the checklist regulated deployments actually get audited on.
Lineage on every query
Column-level OpenLineage events emitted as queries run, and data products registered in DataHub. Your governance platform defines policy; Dataglot makes it a query-time guarantee.
Tested like your queries depend on it
Every night, Dataglot runs differential tests against established SQL engines, TPC-H baselines, and a browser testbench that compares results row by row across engines.