Data Export Authorization — Gate Bulk Data Exports

Data Exports Are High-Risk

Bulk data exports can exfiltrate sensitive data, expose PII, or violate data residency requirements. Once data leaves your system, you can't get it back.

TrigGuard authorizes exports before they execute. Every export gets a signed receipt documenting who authorized it.

What Gets Authorized

Database Dumps

pg_dump, mysqldump, mongodump. Full or partial database exports.

Analytics Extracts

BigQuery exports, Snowflake unloads, data warehouse extracts.

Backup Downloads

Downloading backup files from storage to local machines.

Batch Exports

Scheduled or ad-hoc bulk data pipelines to external systems.

Integration Example

# Wrap pg_dump with TrigGuard authorization
tg exec --surface data.export --action pg-dump \
  --context '{"database": "production", "tables": ["users", "orders"]}' \
  -- pg_dump -h prod-db -d myapp -t users -t orders > export.sql

# TrigGuard blocks if not authorized
[TrigGuard] Requesting authorization...
[TrigGuard] Decision: DENY
[TrigGuard] Reason: bulk_export_requires_approval
[TrigGuard] Export blocked. Request approval first.

Policy Examples

PII Tables Require explicit approval for tables with PII

Size Limits Block exports over configurable row count

Time Windows Allow exports only during business hours

Destination Check Only allow exports to approved destinations

Compliance Benefits

Every export produces a signed receipt. Answer "who exported this data and when?" with cryptographic proof.

GDPR / Data Residency

Document authorization for data transfers. Prove compliance with data residency requirements. Audit trail for Subject Access Requests.

Protect Your Data

Add authorization gates to data export workflows. Start protecting exports in 10 minutes.

Integration Guide Request Access