Ark's documented answer
Each Ark cell describes current product behavior. Confirm it in the documentation and in your own pilot environment.
Evidence-led Evaluation
Compare Ark with evidence, not labels
Use the same proof checklist for Ark and every alternative. The matrix documents Ark's current behavior and the validation to run during an evaluation; it does not infer capabilities from vendor names or product categories.
How to use this evaluation matrix
Require working proof
Run the same scenario against every shortlisted platform and retain its output, logs, and network evidence.
Compare the exact scope
Capabilities can change by edition, version, add-on, and deployment model. Validate the configuration you would actually buy.
Last reviewed August 2026. This is an evaluation guide, not an independent benchmark; verify current behavior before making a purchase decision.
| Feature | Ark's answer | What to verify in every platform |
|---|---|---|
| Data Discovery & Classification PII Discovery & Classification | Multi-pipeline (schema, DeID, HuggingFace, Ollama, agentic orchestrator) | Proof step Add or rename a sensitive column, rerun discovery, and compare the resulting classification, confidence, and change record. |
| Drift Detection & Reclassification | Automatic — detects schema changes, reclassifies incrementally | Proof step Add or rename a sensitive column, rerun discovery, and compare the resulting classification, confidence, and change record. |
| Data Masking Structured Data Masking | Column masking with configurable strategies | Proof step Test typed columns, free text, and nested JSON with representative edge cases; then check consistency and referential behavior. |
| Free-Text / Unstructured Masking | PII inside TEXT, VARCHAR, JSON via NER | Proof step Test typed columns, free text, and nested JSON with representative edge cases; then check consistency and referential behavior. |
| Nested JSON / Blob Parsing & Masking | Recursive JSON key scanning and masking | Proof step Test typed columns, free text, and nested JSON with representative edge cases; then check consistency and referential behavior. |
| Test Data Management Referential Integrity Subsetting | FK-aware graph-based, cyclic-safe, composite key support | Proof step Use a cyclic foreign-key dataset, create and reset a disposable CI database, and inspect lineage, repeatability, cleanup, and audit output. |
| Governed Business Object Templates | Versioned root-entity graphs with parameters, table roles, virtual FKs, and schema-assisted suggestions | Proof step Use a cyclic foreign-key dataset, create and reset a disposable CI database, and inspect lineage, repeatability, cleanup, and audit output. |
| Deterministic Scenario Anchors | Version-pinned, parameterized SQL fixtures after subset or provisioning, with ordered execution and audit results | Proof step Use a cyclic foreign-key dataset, create and reset a disposable CI database, and inspect lineage, repeatability, cleanup, and audit output. |
| Golden Snapshots & Data Virtualization | Versioned and tagged approved baselines with copy-on-write clone reuse for repeatable QA, CI, and demo environments | Proof step Use a cyclic foreign-key dataset, create and reset a disposable CI database, and inspect lineage, repeatability, cleanup, and audit output. |
| Ephemeral Test DB Provisioning | Docker/Testcontainers, TTL-based auto-destroy, CLI --wait | Proof step Use a cyclic foreign-key dataset, create and reset a disposable CI database, and inspect lineage, repeatability, cleanup, and audit output. |
| Federated Synthetic Data Generation | In-VPC embedded Go synthgen — data never leaves network | Proof step Use a cyclic foreign-key dataset, create and reset a disposable CI database, and inspect lineage, repeatability, cleanup, and audit output. |
| Security & Architecture Agent Connectivity Model | Outbound-only mTLS gRPC — no open inbound ports | Proof step Draw the real data and control-plane flow; list inbound rules, credentials, certificate rotation, stored payloads, and every network destination. |
| Authentication Method | mTLS — per-agent X.509 client cert, no shared secrets | Proof step Draw the real data and control-plane flow; list inbound rules, credentials, certificate rotation, stored payloads, and every network destination. |
| Data Residency / In-VPC Execution | Agent in customer VPC + optional self-hosted control plane — metadata only to SaaS when using cloud | Proof step Draw the real data and control-plane flow; list inbound rules, credentials, certificate rotation, stored payloads, and every network destination. |
| Tamper-Evident Audit Logs | Hash chain + append-only + WORM archive to MinIO/S3 | Proof step Draw the real data and control-plane flow; list inbound rules, credentials, certificate rotation, stored payloads, and every network destination. |
| Governance & Compliance Compliance Framework Alignment | GDPR, CCPA, SOC 2 — extensible locale plugin architecture | Proof step Follow one privacy or approval request end to end and retain the approvals, evidence, exports, and immutable audit records it creates. |
| Privacy Request (DSAR) Fulfillment | Built-in workflow with discovery, fulfillment stepper, audit | Proof step Follow one privacy or approval request end to end and retain the approvals, evidence, exports, and immutable audit records it creates. |
| Developer Experience Configuration Model | Config-driven — one approved flow reused across teams & pipelines | Proof step Start from a clean CI runner and complete the workflow using supported CLI or SDK paths; record dependencies, manual steps, and failure recovery. |
| SDK / CLI Support | Go SDK, JS SDK, CLI (ark-cli) | Proof step Start from a clean CI runner and complete the workflow using supported CLI or SDK paths; record dependencies, manual steps, and failure recovery. |
| CI Integration | ark-cli testenvs create --wait + SDK methods | Proof step Start from a clean CI runner and complete the workflow using supported CLI or SDK paths; record dependencies, manual steps, and failure recovery. |
| Runtime / Dependencies | Single Go binary — no JVM, no Python, no sidecar | Proof step Start from a clean CI runner and complete the workflow using supported CLI or SDK paths; record dependencies, manual steps, and failure recovery. |
| Database Support Supported Databases | PostgreSQL, MySQL | Proof step Run the exact database engine, version, extensions, data types, and topology planned for production-like testing. |
At a glance
Ark design choices to validate
Drift Detection & Reclassification
Ark detects schema changes and can run incremental reclassification in the same workflow. Validate it by introducing a sensitive column and inspecting the resulting change record.
Outbound-Only Agent Security
Ark's agent initiates an outbound mTLS connection and uses a per-agent X.509 certificate. Validate firewall rules, certificate rotation, and control-plane destinations in your environment.
Federated In-VPC Synthesis
Ark can execute synthetic data generation inside the customer network. Confirm the data path with packet-level evidence and verify what metadata, if any, reaches the control plane.
End-to-End Pipeline
Ark connects classification, masking, subsetting, and disposable database provisioning in one governed flow. Run the full path in CI and count every external dependency and manual handoff.
Extensible Locale Plugin Architecture
Ark's DeID layer uses a global base with pluggable locale extensions, making it straightforward to adapt PII detection and masking rules for any regional regulatory framework — GDPR, CCPA, LGPD, or beyond.
Tamper-Evident Audit Logs
Hash-linked append-only audit logs with WORM archive export to MinIO/S3. Each record is chained to the previous event hash — critical for regulated industries.
Run the checklist yourself
Use one source, one approved configuration, and one masked sandbox to validate the complete workflow in your own environment.