For data connectors that support it, to indicate that Tonic Structural should trust the server certificate, toggle Trust Server Certificate to the on position.

For data connectors that support it, the Enable SSL/TLS setting indicates whether to encrypt the database authentication.

By default, it is in the on position. We strongly recommend that you do not turn off this setting.

For each workspace, you select the connector type.

After you select the connector type, you configure:

• Where to find the source data

• Where to write the data generation output

• How to make the connections

Not all connectors support all of the connection options. The workspace configuration information for each connector type lists the supported settings.

You can associate custom tags with each workspace. Tags can help to organize and provide a quick glance into the workspace configuration.

Tags are accessible to every user that has access to the workspace.

Tags are stored in the workspace JSON, and are included in the workspace export. You can also use the API to get access to tags.

Managing tags from workspace settings

You can add and edit tags in the Tags field on the New Workspace and Workspace Settings views.

• To add tags, enter a comma-separated list of the tags to add.

• To remove a tag, click its delete icon.

You can also manage tags directly from Workspaces view.

To add tags to a workspace that does not currently have tags:

1. Hover over the Tags column for the workspace.

2. Click Add Tags.

3. In the tag input field, type a comma-separated list of tags to apply.

4. Press Enter

To edit the assigned tags:

1. Click the Tags column for the workspace.

2. In the tag input field, to remove tag, click its delete icon.

3. To add tags, type a comma-separated list of the tags to add.

4. To save the tag changes, press Enter

On the Team Settings page, the Workspaces Without an Owner tab displays the list of workspaces that do not currently have an owner.

This typically happens when the owner is removed from Structural.

These workspaces do not display on the Workspaces view.

Displaying the list

To display the list:

1. In the user menu, click Team Settings.

2. On the Team Settings view, click Workspaces Without an Owner.

For each workspace, the list includes:

• The workspace name.

• The email address of the previous owner.

You can filter the list based on the workspace name or the previous owner email address.

To filter the list, begin typing text in either the workspace name or the owner email address.

As you type, Structural updates the list to only include matching workspaces.

You can transfer one or more workspaces to a different owner.

1. To transfer a single workspace, click its Transfer option. To transfer multiple workspaces:

   1. Check the checkbox for each workspace to transfer.

   2. Click Actions, then click Transfer.

1. From the New owner dropdown list, select the new owner.

2. Click Transfer.

The new owner is assigned the owner permission set for the transferred workspaces.

You can also delete workspaces.

To delete a single workspace, click its Delete option.

To delete multiple workspaces:

1. Check the checkbox for each workspace to delete.

2. Click Actions, then click Delete.

A Tonic Structural workspace provides a context within which to configure and generate transformed data.

A workspace represents a path between the source data and the transformed output data. For example, postgres-prod-copy to postgres-staging.

A workspace includes:

• Where to find the source data to transform during data generation

You can export a workspace configuration to a JSON file, and import configuration from a workspace configuration JSON file.

For example, you might want to preserve a version of the workspace configuration before you test other changes. You can then use the exported file to restore the original configuration.

Or you might want to use a script to make changes to an exported configuration file. You can then import the updated file to update the workspace configuration.

The workspace JSON configuration file includes the following information:

• Sensitivity designations that you assigned to columns

Jobs view displays the list of jobs for the workspace.

To display Jobs view:

• On the workspace management view, in the workspace navigation bar, click Jobs.

• On Workspaces view, from the dropdown menu in the Name column, select Jobs.

On Jobs

You can cancel Queued or Running jobs.

For jobs with those statuses, the rightmost column in the job list contains a cancel icon.

To cancel the job, click the icon.

For the the following types of jobs:

• Sensitivity scans

• Data generation jobs

• Upsert jobs

Overall interaction flows with an LLM

The following diagrams show the general interaction between Structural and an LLM based on the Structural deployment.

Structural Cloud

On Structural Cloud, all users use the same LLM, which is managed by Tonic.ai.

Self-hosted instances that use the hosted LLM

Self-hosted instances can choose to use the LLM that Tonic.ai maintains.

For each customer, requests to the LLM are routed through a SaaS proxy to the hosted LLM in the appropriate region.

Self-hosted instances that use their own LLM connection

Self-hosted instances can also establish their own connection to an LLM.

Flows for AI features

The following flows show the request and results for specific Structural AI features.

LLM-based sensitivity detection

Here is a high-level flow of LLM-based sensitivity detection.

To complete the analysis, Structural sends the following to the LLM to complete the analysis:

• Database schema.

• By default, sample source data values.

• LLM-based sensitivity rules

To manage LLM-based sensitivity detection:

• You can exclude the sample data, and only send the schema information.

• You can disable it entirely.

For more information go to the information on configuring AI-based functionality for and on .

Here is a high-level overview of a Structural Agent interaction:

When it sends your prompts to the LLM, to provide context for tasks such as recommending generators, Structural also sends:

• The database schema.

• By default, representative data samples.

You can configure Structural to never send any sample data to the LLM. This configuration would also prevent data from being sent as part of the LLM-based sensitivity detection.

For more information go to the information on configuring AI-based functionality for and on .

The and generators both include a prompt field to use to configure the generator.

Structural sends the prompt to the LLM. The LLM returns the list of values or the template.

When a data connection test fails, Structural provides an option to use the LLM to troubleshoot the issue.

Structural sends to the LLM the connection details and the error. The LLM analyzes the information and returns suggestions for how to resolve the connection issue.

Structural stores your Structural Agent conversations on your computer, in your local browser storage.

On Structural Cloud and on our hosted LLM, our usage of information specifically follows the usage policy for .

For all LLM-based interactions, input prompts and generated responses are only used for workspace data analysis and configuration.

Prompts and responses are never used to train the underlying models.

However, as a best practice, we recommend that you do not include highly sensitive values in your manual prompts.

Job types

Tonic Structural runs the following types of jobs on a workspace:

• Sensitivity scans - Analyze the source database to identify sensitive data.

• Collection scans - Analyze the source data for a MongoDB workspace to determine the available fields in each collection, the field types, and how prevalent the fields are.

• Schema retrieval jobs - Refresh the cached version of the source database schema.

• Data generation, data pipeline generation, and containerized generation jobs - Generate the destination data from the source data.

• Upsert data generation jobs - Generate the intermediate database from the source database.

• Upsert jobs - Use data from the intermediate database to add new rows to and update changed rows in the destination database. If the migration process is enabled, then it is a step in the upsert job.

• SDK table statistics jobs - Only run when you use the SDK to generate data in a Spark workspace, and the assigned generators require the statistics.

A job can have one of the following statuses:

• Queued - The job is queued to run, but has not yet started. A job is queued for one of the following reasons:

  • Another job is currently running on the same workspace. For example, you cannot run a sensitivity scan and a data generation, or multiple data generations, at the same time on the same workspace. This is true regardless of the number of workers on the instance. On Structural Cloud, there is also a limit on the number of concurrent running jobs for each organization. When that maximum is reached, a new job remains queued until a current running job completes.

  • There isn't an available worker on the instance to run the job. A Structural instance with one worker can only run one job at a time. If a job from one workspace is currently running, a job from another workspace cannot start until the first job is finished.

Each of these statuses has a corresponding "with warnings" status. For example, Running with warnings, Completed with warnings. A "with warnings" status indicates that the job had at least one warning at the time of the request.

You can view a list of jobs for the workspace, and view details for individual jobs. From the job details, you can download job information.

You can also use the Structural Agent to get information about jobs and diagnose failed jobs. For example:

How many data generation jobs have run for this workspace?

How many columns were de-identified during the most recent successful data generation?

When was the most recent sensitivity scan for this workspace? How many sensitive columns did it identify?

Why did the most recent data generation job fail? What's the solution to enable the job to complete successfully?

For jobs other than Queued jobs, you can display details about the workspace and the job progress.

Displaying the job details view

From the Jobs view, to display the details for a job, click the job row.

Information on the job details view

Workspace information

The left side of the job details view contains the workspace information.

For a sensitivity scan, the workspace information is limited to the owner, database type, and worker version.

For a data generation job, the workspace information also includes:

• Whether subsetting, post-job scripts, or webhooks are used.

• The number of schemas, tables, and columns in the source database.

• The number of schemas, tables, and columns in the destination database.

The Job Log tab shows the start date, start time, and duration of the job, followed by the list of job process steps.

For data generation jobs, the Privacy Report tab displays the number of at-risk, protected, and not sensitive columns in the source database.

At-risk columns contain sensitive data, but still have Passthrough as the assigned generator.

Protected columns have an assigned generator other than Passthrough.

Not sensitive columns have Passthrough as the assigned generator, but do not contain sensitive data.

The job identifier is a unique identifier for the job. To copy the job identifier, either:

• From Jobs view, click the copy () icon in the leftmost column.

• From the job details view, click Copy Job ID.

From the job details view, you can display a Gantt chart that shows the flow of a data generation job over time. The chart can help you to understand the different steps of a data generation job and how long it takes Structural to complete each step.

Note that this option is only available for data generation jobs that use the newer data generation process. For more information, go to . Data generation jobs that use the older process do not produce the Gantt chart.

To display the chart, click Reports and Logs, then select View Gantt.

The Job Visualization page displays the Gantt chart of the job progress.

If you have multiple workspaces, then it is likely that many of the workspace components and configurations are the same or similar. It can be difficult to maintain that consistency across separate, independent workspaces.

When you copy a workspace, the new workspace is completely independent of the original workspace. There is no visibility into or inheritance of changes from the original workspace.

Workspace inheritance allows you to create workspaces that are children of a selected workspace. Unlike a copy of a workspace, a child workspace remains tied to its parent workspace.

By default, a child workspace's configuration is synchronized with the configuration of the parent. In other words, any changes to the parent workspace are copied to its child workspaces. Child workspaces can also override some of the parent configuration. From the parent workspace, you can track the child workspaces and how they are customized .

For example, you might want separate workspaces for different development teams. Each team can make adjustments to suit their specific projects - such as different subsets - but inherit everything else.

By default, a child workspace inherits all of the configuration from the parent workspace, except for the following:

You use the workspace management view to configure and run data generation for an individual workspace.

When you log in to Tonic Structural, it displays the workspace management view for the workspace that was selected when you logged out.

The workspace management view includes the following components.

The top left of the workspace management view provides information about the workspace, including:

• The workspace name

How chat conversations are stored

Tonic Structural stores chat conversations in browser storage.

Using the AI Agent tab

The AI Agent tab provides a full-page view of the Structural Agent chat.

Using the AI Agent chat panel

In addition to the AI Agent tab, you can use the AI Agent chat panel, which allows you to interact with the Structural Agent while you view Structural pages.

Available display types

The chat panel supports the following display options.

Side-by-side

With the Side-by-side option, the agent chat panel displays next to the Structural page.

To accommodate the chat panel, the Structural page becomes narrower.

You can display the chat panel on the left or right side of the screen.

Overlay

With the Overlay option, the agent chat panel displays on top of the Structural page.

You can display the chat panel on the left or right side of the screen.

From the chat panel, to select the display type:

1. Click the chat panel options menu.

2. In the menu, click the display type.

To also select the Agent chat panel location, click the location option under the display type.

For example, if you select the Move to right side option under Side-by-side, then the chat panel both changes to the side-by-side view and displays at the right.

If you don't select a specific location, then the chat panel uses the most recently selected location.

To change the display location:

1. Click the chat panel options menu.

2. For the selected display option:

   • To move the chat panel to the left, click Move to left side.

   • To move the chat panel to the right, click Move to right side.

To hide the chat panel, either:

• Click the hide icon at the top right.

• In the options menu, click Hide.

To display the chat panel, click the chat panel icon. The icon displays at the bottom right of each Structural page.

To adjust the chat panel width, click and drag the panel border.

The Structural Agent chat remains in place across the entire Structural application.

You can read information about data from any workspace that you have access to. For example, you can get a summary list of workspaces organized by data connector, identify unprotected columns in any workspace, or find the workspace with the most recent failed job.

However, you can only perform configuration or generation actions based on the current context. For example, you can only change the configuration for a workspace if you are currently in the workspace management view for that workspace. The Structural Agent can navigate to the workspace that you want to work with.

As you navigate to different workspaces or to views outside of a workspace, the Structural Agent chat notes the change in context, and provides links to allow you to navigate to each context.

You can create multiple conversations within the Structural Agent chat. For example, you might start a new conversation when you change to a different workspace.

From the Structural Agent chat, to start a new conversation, click the conversation dropdown, then select New Conversation.

Structural automatically assigns a name to each new conversation, based on the current context.

To assign a new name to the current conversation:

1. Click the conversation dropdown, then click Rename.

2. In the name field, provide the new name.

3. Click Save.

To change to a different conversation, from the conversation dropdown, select the conversation to change to.

To delete the current conversation:

1. Click the conversation dropdown, then click Delete.

2. On the confirmation panel, click Delete.

Structural deletes the current conversation and switches you to the first available conversation.

When you delete a conversation, Structural also removes it from the browser storage.

While the Agent is working, to stop the response and cancel the action, in the chat prompt, click the stop response icon.

Before it performs an action to modify the workspace, the Agent takes snapshots of the current workspace configuration.

To undo an action, or to revert to a previous point from the current conversation, prompt the Agent.

For example:

• Undo that action.

• Revert the generator assignments for the datetime columns.

• Go back to before we assigned generators to the name columns.

If needed, the Agent can ask you to select a snapshot to revert to.

To redo an action, cick the redo icon.

A response from the Agent might be useful elsewhere. For example, you can prompt the Agent to generate Structural API calls, or the Agent might return a useful summary of the data and its status.

To copy the most recent Agent response, click the copy icon.

You can provide basic positive or negative feedback to indicate the helpfulness of a response. The Agent then uses that feedback to adjust its future responses in the current chat.

To provide positive feedback, click the thumbs up icon.

To provide negative feedback, click the thumbs down icon.

Creating a workspace

When you create a new workspace, you can either:

• Create a completely new workspace.

• Create a copy of an existing workspace. The copy initially uses the configuration from the original workspace. After the copy is created, it is completely independent from the original workspace.

• Create a child of an existing workspace. Child workspaces inherit configuration from the parent workspace. They continue to be updated automatically when the parent workspace is updated. For more information, go to .

You can also view this .

When you create a workspace, a new chat starts for the workspace.

To create a completely new workspace, on Workspaces view, click Create Workspace > New Workspace.

For information about the configuration settings for a workspace, go to .

On the new workspace view, the carousel at the bottom left includes an option to create a workspace that uses sample data that we provide. On the carousel, click the right arrow until the sample dataset option is selected.

To create a workspace based on an existing workspace, either:

• On the workspace management view of the workspace to copy, from the workspace actions menu, select Duplicate Workspace.

• On Workspaces view, click the actions menu for the workspace, then select Duplicate Workspace.

When you create a copy of a workspace, the copy initially inherits the following workspace configuration:

• Source and destination database connections

• Sensitivity designations, including manual designations that override the sensitivity scan results

• Table mode assignments

• Generator configuration

You can create a workspace that is a child of an existing workspace. You cannot create a child workspace of another child workspace.

The parent workspace must have a source database configured. You cannot create a child workspace from a workspace that uses the Databricks, self-managed Spark cluster, or MongoDB data connector.

To create a child workspace from within a specific workspace, either:

• On Workspaces view, click the actions menu for the parent workspace, then select Create Child Workspace.

• On the workspace management view, from the workspace actions menu, select Create Child Workspace.

On the new child workspace view, Parent Workspace identifies the parent workspace.

To create a child workspace from outside of a specific workspace:

• On Workspaces view, click Create Workspace > Child Workspace.

• On the new workspace view, in the carousel at the bottom left, click to navigate to the Create a child workspace view, then click Create child workspace.

When you use one of these options to create a child workspace, then Parent Workspace is not populated.

From the Parent Workspace dropdown list, select the parent workspace for the new child workspace.

To edit the configuration for an existing workspace, either:

• On the workspace management view:

  • On the workspace navigation bar, click Workspace Settings.

  • From the workspace actions menu, select Workspace Settings.

You can delete workspaces that you no longer need.

You cannot delete a parent workspace. You must first delete all of its child workspaces.

To delete a workspace:

• On the workspace management view, from the workspace actions menu, select Delete Workspace.

• On the Workspaces view, click the actions menu for the workspace, then select Delete.

• On the Workspace Settings view, click Delete Workspace.

The table list at the left of Database View contains the list of tables in the source database. You can filter the table list and assign tables modes to the tables.

You can use the Structural Agent to filter Database View to a specific table. For example:

• Display the products table on Database View.

• Show me the stores and vendors tables on Database View.

Information in the table list

The table list is grouped by schema. You can expand and collapse the list of tables in each schema. This does not affect the displayed columns.

For a workspace, each table corresponds to a file group.

For each table, the table list includes the following information:

• The name of the table.

• The number of columns that have an assigned generator (a generator other than Passthrough). The number does not display if none of the table columns has an assigned generator.

• The . The table list only shows the first letter of the table mode:

  • D = De-identify

For a child workspace, if the selected table mode overrides the parent workspace configuration, then the override icon displays.

To display for a table, click the arrow icon to the right of the table entry.

You can filter the table list and . You can also filter the tables based on .

As you filter the table list, the column list also is filtered to only include the columns for the filtered tables.

To filter the table list by name, in the filter field, begin to type text that is in the table name.

As you type, Tonic Structural filters the list to only display tables with names that contain the filter text.

To filter the table list based on the assigned table mode:

1. Click Filters.

2. On the filter panel, check the checkbox next to each table mode to include. By default, the list includes all of the table modes. As you check and uncheck the table mode checkboxes, Structural adds and removes the associated tables from the list.

You can filter the table list to only display tables that have no assigned generators:

1. Click Filters.

2. On the filter panel, to only show tables that do not have assigned generators, check the No Generators Applied checkbox.

The table mode determines the number of rows and columns in the destination database. For details about the available table modes and how they work, go to .

To change the assigned table mode for a single table:

1. Click the table mode dropdown next to the table name.

2. From the table mode dropdown list, select the table mode.

3. For a child workspace, the table mode selection panel indicates whether the selected table mode is inherited from the parent workspace. If the child workspace currently overrides the parent workspace configuration, then to reset the table mode to the table mode that is assigned in the parent workspace, click Reset.

To change the assigned table mode for multiple tables:

1. Check the checkbox for each table to change the table mode for. To select a continuous range of tables, click the first table in the range, then Shift-click the last table in the range. To select all of the tables in a schema, click the schema name.

2. Click Bulk Edit.

3. On the panel, click the radio button for the table mode to assign to the selected tables.

The bulk edit option on Database View allows you to configure multiple columns at the same time. From the bulk editing panel, you can:

• Mark the selected columns as sensitive or not sensitive.

• Assign a generator to the selected columns.

• Apply the recommended generator to the selected columns.

• Reset the generator configuration to the baseline. This option requires that all of the selected columns are assigned the same preset.

Depending on the column selection, you can also create a new sensitivity rule.

To select the columns and display the bulk edit option:

1. Check the checkbox next to each column to update.

2. Click Bulk Edit.

On the Bulk Edit panel, under Sensitivity:

• To mark the selected columns as sensitive, click Sensitive.

• To mark the selected columns as not sensitive, click Not Sensitive.

On the Bulk Edit panel, under Bulk Edit Applied Generator, select and configure the generator to assign to the selected columns.

If any of the selected columns have a recommended generator, then on the Bulk Edit panel, the Generator recommendations found panel displays. The panel indicates the number of selected columns that have a recommendation.

To assign the recommended generators to those columns, click Apply.

For a generator preset, the baseline configuration is the configuration that is saved for that preset. The baseline configuration determines the default configuration to use when you assign the preset to a column. After you select the preset, you can override the baseline configuration.

If all of the selected columns are assigned the same preset, then to restore the baseline configuration for all of the columns, click Reset, then select Reset to Generator Preset.

You might bulk edit columns that could benefit from a custom sensitivity rule.

For example, in your data, the Widget column is in multiple tables and contains sensitive data that Structural cannot identify. You select all of the Widget columns so that you can mark them as sensitive and apply the Character Scramble generator to them.

However, a custom sensitivity rule would ensure that in the future, Widget columns are always marked as sensitive and have the Character Scramble generator recommended.

On the Bulk Edit panel, when all of the selected columns:

• Have the same data type.

• Do not have a generator assigned.

• Do not have a recommended generator.

Then Structural displays the Create a Sensitivity Rule panel, which contains the option to create a new sensitivity rule.

To create a sensitivity rule:

1. Click Create Custom Rule.

2. On the Create Custom Rule view, configure the new sensitivity rule. Structural automatically selects a data type based on the selected columns. The current workspace is used as the testing workspace to verify the columns that match the rule configuration. For details about the sensitivity rule configuration, go to .

3. When you finish configuring the new rule:

Structural closes the sensitivity rule configuration view and returns you to Database View. It maintains the previous column selection.

If you did not apply the generator preset, then the sensitivity rule is included in the next sensitivity scan.

When you first connect to a database, Tonic Structural performs a scan to determine the available fields in each collection, the field types, and how prevalent the fields are. It performs this scan at the same time as the initial sensitivity scan.

For each collection, Structural creates a hybrid document, which is a superset of all of the fields contained in the collection documents.

By default, for each collection:

• The scan includes all of the documents in the collection, and continues until the scan is finished.

• Every unique path (field+data type) in the collection is added to the hybrid document.

For workspaces that are configured to write destination data to a container repository, the Jobs view also provides access to the generated artifacts. For more information, go to .

For all jobs, the job logs provide detailed information about the job processing. Tonic.ai support might request the job logs to help diagnose issues.

For upsert jobs where the migration process is enabled, and you configured the GET Schema Change Logs endpoint, the upsert job logs include the migration process logs.

You can download the job logs from the Jobs view or the job details view. The download includes up to 1MB of log entries.

On the Jobs view, to download the logs for a job, click the download icon in the rightmost column.

On the job details view, to download the logs for a job, click Reports and Logs, then select Job Logs.

Generates a random company name-like string.

This is a .

A version of the generator that can be used for array values.

Runs a selected generator on values that match a user-specified .

This is a .

A version of the generator that can be used for array values.

Uses regular expressions to parse strings and replace specified substrings with the output of specified generators. The parts of the string to replace are specified inside unnamed top-level capture groups.

Generates a random mailing address-like string.

You can indicate which part of an address string that the column contains. For example, the column might contain only the street address or the city, or it might contain the full address.

For an individual column in Database View, you can configure the assigned generator and determine the column sensitivity.

From the column list, to display the generator configuration panel, in the Applied Generator column, click the generator name tag.

The Structural sensitivity scan provides an initial indication of whether a column is sensitive and, if it is sensitive:

• The type of sensitive data that is in the column.

• The confidence level of the sensitivity detection.

Structural currently supports:

• AWS Secrets Manager

• HashiCorp Vault

• Cyberark Central Credential Provider

By default, when a Structural security scan runs on a workspace, it looks for the built-in sensitivity types.

You can also define custom sensitivity rules to identify other values and the corresponding recommended generator. Your data might include values that are specific to your organization.

To identify the columns that the sensitivity rule applies to, you can either:

• Match text in the column name.

• Provide a description to tell the LLM what to look for. The LLM-based sensitivity scan then matches the description against the source data columns.

For both types of custom sensitivity rule, you identify the applicable column data type, and select the generator preset to apply to matching columns.

LLM-based sensitivity rules are processed as part of the LLM-based sensitivity detection. When LLM-based sensitivity detection is not used, then the LLM-based sensitivity rules also are not used.

On self-hosted instances, even if LLM-based sensitivity detection is enabled, an additional environment setting specifically enables LLM-based sensitivity rules.

For more information, go to and .

To display the current list of sensitivity rules, in the Structural navigation menu, click Sensitivity Rules.

On the Sensitivity Rules page:

• The Column Name rules list contains the list of sensitivity rules that check for a text or regular expression match in the column name.

• If LLM-based sensitivity rules are enabled, then the LLM-based rules list is displayed and contains the list of sensitivity rules that use the rule description as input for the LLM-based security scan. The LLM-based scan uses the description to check for matching columns.

The lists contain sensitivity rules for a self-hosted Structural instance or a Structural Cloud organization.

For each rule, the list includes:

• The rule name and description

• The recommended generator preset

• When the rule was most recently modified

You can filter each rule list by the following:

• Rule name

• Rule description

• Generator preset name

• Name of the user who most recently updated the rule

In the filter field, start to type text from any of those values. As you type, the list is filtered to only include matching rules.

Note that when the list is filtered, you cannot change the display sequence of the rules.

For each type of rule, Structural applies the rules based on their display order in the list. If a column matches more than one rule, Structural applies the first matching rule.

Column name rules take precedence over LLM-based rules. When a column matches both a column name rule and an LLM-based rule, the column name rule is used.

To change the display order of a rule, drag and drop it to the new location in the list.

Note that you cannot change the rule sequence when the list is filtered.

To create a sensitivity rule:

1. On the Sensitivity Rules view, click New Custom Rule.

2. On the Create Custom Rule view, .

3. Click Save.

To change the configuration of a sensitivity rule:

1. On the Sensitivity Rules view, click the edit icon for the rule.

2. On the Edit Custom Rule view, .

3. Click Save.

Note that any changes to a sensitivity rule do not take effect until the next sensitivity scan.

In the Name field, type the name of the sensitivity rule. The rule name becomes the sensitivity type for matching columns.

The rule name:

• Must be unique.

• Cannot match the name of a built-in sensitivity type.

For column name sensitivity rules, use the Description field to provide an optional longer description of the sensitivity rule and how it is used.

For LLM-based sensitivity rules, the content of the Description field is what Structural sends to the LLM during LLM-based sensitivity detection. When providing the description for the LLM, to ensure the most accurate matches, be as specific as possible.

Note that if Structural is configured to not send sample data to the LLM, and the description refers to the column value and not the column name, the LLM cannot identify matching columns.

When both column name and LLM-based sensitivity rules are enabled, then under Match Type, click the type of rule.

• To create a column name rule, click Column Name.

• To create an LLM-based rule, click Description (LLM).

After you save the rule, you cannot change the rule type.

From the Data Type dropdown list, select the data type for matching columns. For example, a rule might only be used for columns that contain text.

The available data types are general types that map to specific data types in a given database. The available types are:

• Array

• Binary

• Boolean

• Continuous Numerical

Under Column Name Match, provide the criteria to identify matching columns based on the column name.

Note that a matching column must match both the data type and the column name criteria.

When you provide a list of text matching conditions, a matching column must match all of the conditions. In other words, the conditions are joined by AND.

To apply the same generator preset to columns that have completely different names, you must create separate sensitivity rules.

To create a list of text matching conditions:

1. Click Text Match.

2. To add a column name condition, click Add String Match.

3. For each condition:

   1. From the comparison type dropdown list, select the type of comparison. For example, Contains, Starts with

To use a regular expression to identify matching columns based on the column name:

1. Click Regular Expression.

2. In the field, provide the regular expression.

From the Recommended Generator Preset dropdown list, select the generator preset that is the recommended generator for matching columns.

To search for a specific preset, begin to type the generator preset name.

When you configure a sensitivity rule, you can also create a new generator preset or update the configuration of the selected generator preset.

To create a new generator preset, click Create Preset. On the generator preset details panel, provide the generator preset configuration, then click Create.

To edit the selected generator preset, click Edit Current Preset. On the generator preset details panel, update the generator preset configuration, then click Save and Apply.

For more information about generator preset configuration, go to .

You cannot preview the results of LLM-based sensitivity rules. You can only test column name rules.

If you have access to a workspace, then you can use the workspace to preview the sensitivity rule results.

Under Test Results, from the workspace dropdown list, select the workspace to use.

Structural searches the workspace schema for matching columns based on the sensitivity rule configuration.

It displays any matching columns. You can filter the matching columns based on the table or column name.

For each matching column, the list includes:

• The column name and table

• A sample value from the source data. The sample source value is only present if you have the Preview source data permission for the workspace.

• A sample replacement value, based on the selected generator preset for the sensitivity rule. The sample replacement value is only present if you have the Preview destination data permission for the workspace.

To delete a sensitivity rule, on the Sensitivity Rules view, click the delete icon for the rule.

Note that existing generator recommendations for the rule remain in place until the next sensitivity scan.

Self-hosted customers can choose whether to enable AI features on their instance.

A self-hosted instance can either:

• Use an LLM that Tonic.ai hosts. This is the default option.

• Configure a connection to a supported LLM provider.

• Not use an LLM at all. This disables all Structural AI features.

You configure the connection either:

• From the AI Settings tab on Structural Settings.

• Using . The settings can be added to the Environment Settings list on Structural Settings.

If you enable AI features, then Structural provides additional options to .

Tonic Structural supports the following LLM providers:

• Anthropic

• Anthropic on Amazon Bedrock

• OpenAI. Note that we are continuing to test OpenAI for the Structural Agent.

Structural provides a hosted LLM that you can use to support the Structural AI features. The hosted LLM uses Anthropic on Amazon Bedrock.

For new self-hosted instances, this is the default option.

The LLM is hosted in multiple locations. Structural routes the request through a SaaS proxy to the appropriate location for the customer.

On AI settings view, to use the hosted LLM:

1. From the LLM Provider dropdown list, select Tonic.ai-hosted LLM.

2. From the from the Region dropdown list, select the hosted LLM location to use.

3. To test the connection to the hosted LLM, click Test Tonic.ai-hosted LLM Connection.

To use the to select the hosted LLM:

• Set TONIC_LLM_PROVIDER to TonicHosted.

• Set TONIC_HOSTED_REGION to either US or EU.

If you use the hosted LLM, make sure to allowlist the SaaS proxy, either:

• http://us-east-1.saasproxy.tonic.ai/ or 98.84.248.119 (US location)

• http://eu-central-1.saasproxy.tonic.ai/ or 3.120.214.225 (EU location)

To not connect to an LLM, which disables Structural AI features, from the LLM Provider dropdown list, select Do not use an LLM.

To use an environment setting to disable Structural AI features, set TONIC_LLM_PROVIDER to LlmOptOut.

If you use a hosted Anthropic deployment, Structural requires the following models:

• claude-opus-5

• claude-sonnet-5

• claude-haiku-4-5

From AI Settings, to configure Anthropic as your LLM:

1. From the LLM Provider dropdown list, select Anthropic.

2. In the Anthropic Endpoint field, enter the Anthropic endpoint URL for generative AI services. Should include the endpoint base URL for the Anthropic API, without the version. The default is https://api.anthropic.com.

3. In the Anthropic API Key field, enter the API key for Anthropic. In production environments, make sure that this is kept secure and encrypted.

To use to connect to Anthropic:

• TONIC_LLM_PROVIDER - Set to Anthropic.

• TONIC_ANTHROPIC_ENDPOINT - The Anthropic endpoint URL. Include the endpoint base URL for the Anthropic API, without the version.

• TONIC_ANTHROPIC_API_KEY - The Anthropic API key.

When you use Anthropic on Amazon Bedrock, you can either:

• Use the environment configuration for AWS authentication.

• Provide an Amazon Bedrock API key.

To call Amazon Bedrock, most model and regions require the use of . The AWS documentation includes information about .

The IAM principal that authenticates the request must be granted the following permissions.

• bedrock:InvokeModel

• bedrock:InvokeModelWithResponseStream

The principal must be able to invoke the cross-Region inference profiles that apply to your Region and model.

By default, Structural uses the following models:

• us.anthropic.claude-haiku-4-5-20251001-v1:0

• us.anthropic.claude-sonnet-5

• us.anthropic.claude-opus-5

Cross-Region inference also requires invoke permission on the underlying foundation model in each AWS Region that the profile spans.

For example, for the US, the principal needs the invoke permission in:

• us-east-1

• us-east-2

• us-west-2

For the recommended IAM policy structure, go to the .

From AI Settings, to use Anthropic on Amazon Bedrock, from the LLM Provider dropdown list, select Anthropic+Bedrock.

To use the environment configuration for authentication, click Environment Configuration.

Structural uses the credentials set in the following :

• TONIC_AWS_ACCESS_KEY_ID - An AWS access key that is associated with an IAM user or role.

• TONIC_AWS_SECRET_ACCESS_KEY - The secret key that is associated with the access key.

• TONIC_AWS_REGION - The AWS Region to send the authentication request to.

If these environment settings are not configured, then Structural uses the .

From AI Settings, to use an Amazon Bedrock API key for authentication:

1. Click API Key.

2. In the Amazon Bedrock API Key field, provide the API key.

Optionally, in the Model Name field, specify the model to use. In most cases, the value is a cross-Region inference profile. For combinations of Region and model that do not require cross-Region inference, the you can provide a model name.

If you do not specify a model, then the default is:

• For lightweight, quick tasks, us.anthropic.claude-haiku-4-5-20251001-v1:0.

• For standard tasks, us.anthropic.claude-sonnet-5.

• For complex, high-quality tasks, us.anthropic.claude-opus-5.

To use to connect to Anthropic on Amazon Bedrock:

• TONIC_LLM_PROVIDER - Set to AnthropicBedrock.

• TONIC_BEDROCK_API_KEY - To use an API key for authentication, set this to the Amazon Bedrock API key. To use the environment configuration for authentication, do not set this setting.

• TONIC_LLM_MODEL - The model to use.

Structural supports any OpenAI deployment that:

• Supports API key authentication.

• Supports the OpenAI Responses API.

• Supports OpenAI proprietary models, such as GPT-4/5.x.

If you use a hosted OpenAI deployment such as Microsoft Foundry, Structural requires the following model deployments. The deployment name must match the model name.

• gpt-4.1-mini

• gpt-4.1

• gpt-5.2

From AI Settings, to use OpenAI as your LLM provider:

1. From the LLM Provider dropdown list, select OpenAI.

2. In the OpenAI Endpoint field, enter the OpenAI endpoint URL to use for AI-enhanced features. Should include the endpoint base URL for the OpenAI API, without the version. The default is https://api.openai.com. Here is an example URL for Microsoft Foundry: https://my-foundry-instance.ai.azure.com/openai

3. In the OpenAI API Key field, enter the API key for OpenAI.

To use to connect to OpenAI:

• TONIC_LLM_PROVIDER - Set to OpenAI.

• TONIC_OPENAI_ENDPOINT - The OpenAI endpoint URL. Include the endpoint base URL for the OpenAI API, without the version.

• TONIC_OPENAI_API_KEY - The API key for OpenAI.

By default, Structural sensitivity detection includes , which sends database information to an LLM.

To disable the LLM-based sensitivity detection, set the TONIC_LLM_ENABLE_ENHANCED_RECOMMENDATIONS to false.

You can set this from the Environment Settings tab on Structural Settings.

LLM-based sensitivity detection also processes LLM-based sensitivity rules. If you disable LLM-based sensitivity detection, then even if you enable LLM-based sensitivity rules, the sensitivity scan does not process any LLM-based sensitivity rules.

On a self-hosted instance, to allow LLM-based sensitivity rules to be created and processed:

• LLM-based sensitivity rules must be enabled - The environment setting TONIC_LLM_ENABLE_CUSTOM_SENSITIVITY_RULES must be set to true. This allows you to create LLM-based sensitivity rules.

• LLM-based sensitivity detection must be enabled - The environment setting TONIC_LLM_ENABLE_ENHANCED_RECOMMENDATIONS must be set to true. This allows LLM-based sensitivity rules to be processed. If this is false, then those rules are ignored.

By default, when LLM-based sensitivity detection is enabled, it sends both the database schema and sample source data values to the LLM.

To exclude the contextual source data, and only send the schema, set the TONIC_LLM_ENABLE_ENHANCED_RECOMMENDATIONS_SAMPLE_DATA to false.

You can set this from the Environment Settings tab on Structural Settings.

To configure Structural to never send sample data for any LLM-based feature, either:

• On AI Settings view, under LLM Data Handling, uncheck Allow LLM access to sample data.

• Set the TONIC_LLM_ENABLE_SAMPLE_DATA to false. You can configure this setting from the Environment Settings tab on Structural Settings.

The Structural sensitivity scan identifies sensitive columns in source data. The scan ignores truncated tables.

When sensitivity scans run

For most data connectors, Structural runs sensitivity scans automatically based on specific events. You can also run manual sensitivity scans on demand.

Sensitivity scans can also run automatically at the same time each week.

Event-based sensitivity scans

Structural automatically runs a sensitivity scan when you:

• Create a completely new workspace and connect a data source.

• Change the data connection details for the source database.

• Add a file group to a file connector workspace.

A child workspace always inherits the sensitivity designations from its parent workspace.

When you copy a workspace, Structural runs a new sensitivity scan on the copy to identify sensitive columns. However, it keeps the sensitivity designation for columns that you specifically marked as sensitive or not sensitive.

To not automatically run event-based sensitivity scans, set the TONIC_DISABLE_PRIVACY_SCAN_AUTORUN to true. You can set this setting from the Environment Settings list on Structural Settings. You can also in individual workspaces.

In addition to the automatic scans, from Privacy Hub, you can .

Structural can also runs scheduled weekly sensitivity scans in the background.

By default, Structural Cloud does not run scheduled scans.

By default, on self-hosted instances, Structural runs sensitivity scans each Sunday at midnight.

The weekly scans run only on the workspaces that had the most recent activity.

• For self-hosted instances, the weekly scans run on the 10 workspaces that had the most recent activity.

• On Structural Cloud, for each organization, the weekly scans run on the 2 workspaces that had the most recent activity.

Activity includes:

• User-initiated updates that are included in the Version History.

• Data generation jobs.

On self-hosted instances, you can configure whether to run the weekly scans, and set the schedule.

To manage the scheduled scans, use the following . You can add these settings to the Environment Settings list on Structural Settings.

• TONIC_ENABLE_SCHEDULED_SENSITIVITY_SCAN - Boolean to indicate whether to enable the scheduled weekly sensitivity scans. The default value is true. To disable the scheduled weekly scan, set this to false.

• TONIC_SENSITIVITY_SCAN_DAY - When scheduled scans are enabled, the day of the week on which to run the scans. The value is an integer between 0 and 6, where 0 is Sunday and 6 is Saturday. The default value is 0.

For improved performance, sensitivity scans can use parallel processing.

For relational databases such as PostgreSQL and SQL Server, to configure parallel processing, you use the TONIC_PII_SCAN_PARALLELISM_RDBMS. The default value is 4.

For document-based databases such as MongoDB, you use the environment setting TONIC_PII_SCAN_PARALLELISM_DOCUMENTDB. The default value is 1.

The Structural sensitivity scan uses the following rules and processes to:

• Identify sensitive columns.

• Recommend generators for those columns. For information about applying recommended generators to columns, go to .

• Indicate its confidence that an identified column is sensitive and is of the detected sensitivity type.

Note that this process cannot guarantee perfect precision and recall. We strongly recommend that a human reviews the sensitivity scan results and the broader dataset to ensure that nothing sensitive was missed.

To identify that a column contains sensitive information for a , Structural looks at the data type, column name, and column values. For the values, Structural uses a random sampling of rows from the data.

This part of the sensitivity scan uses regular expression matching and dictionary lookups. It produces high, medium, or low confidence detections.

When this part of the sensitivity scan determines that a column contains sensitive data, it:

• Marks the column as sensitive

• Assigns the sensitivity type to the column

• Recommends the generator configuration for the identified sensitivity type. Note that if the recommended generator is not compatible with the column, then Structural discards the recommendation.

• Marks the sensitivity detection as high, medium, or low confidence. The confidence level is based on a calculation of how well the column matched the applicable rules.

The sensitivity scan also looks for any columns that match custom sensitivity types that you define in your custom sensitivity rules.

Custom sensitivity rules are based on the column data type and column name. For more information about custom sensitivity rules, go to .

Custom sensitivity rules always produce full confidence detections.

When a column matches a custom sensitivity rule, Structural:

• Marks the column as sensitive.

• Assigns the sensitivity rule name as the sensitivity type.

• Recommends the generator preset from the sensitivity rule.

• Marks the sensitivity detection as full confidence.

Note that if LLM-based sensitivity detection is enabled, then model-based analysis is not used.

To identify additional sensitive columns that might not be captured by the other parts of the scan, the sensitivity scan uses an artificial intelligence (AI) model. Note that the model is pre-trained. Structural does not use customer data to train the model, and it does not send any customer data externally.

This part of the scan produces medium or low confidence detections for built-in entity types.

The model considers the table and column name. If the combination of table and column name is similar in meaning to a sensitivity type that Structural has a recommended generator for, then Structural:

• Marks the column as sensitive.

• Assigns the sensitivity type to the column.

• Recommends the generator configuration for that sensitivity type.

• Uses AI to compare the table name and column name combination to the sensitivity type, and produces a semantic similarity score.

The sensitivity scan can use LLM-based sensitivity detection instead of the model-based analysis.

The LLM-based scan uses the database schema and, optionally, contextual source data, to determine whether a column contains a sensitive value and, if so, the sensitivity type.

This part of the scan produces medium confidence detections for built-in entity types.

The LLM-based sensitivity scan also processes LLM-based sensitivity rules. If LLM-based sensitivity detection is not enabled, then any LLM-based sensitivity rules are not used.

For information about the general flow for LLM-based sensitivity detection, go to .

For information about how to configure the use of LLM-based sensitivity detection, go to or .

To download the log of the most recent sensitivity scan, either:

• On the workspace management view, from the download menu, select Download Sensitivity Scan Log.

• On Privacy Hub, click Reports and Logs, then select Scan Log.

The log tracks the progress of the scan.

If a sensitivity scan fails, you can .

You can configure a workspace to write destination data to a container repository instead of to a database server.

When Structural writes data generation output to a repository, it writes the destination data to a container volume. From the list of container artifacts, you can copy the volume digest, and download a Docker Compose file that provides connection settings for the database on the volume. Structural generates the Compose file when you make the request to download it. For more information about getting access to the container artifacts, go to Viewing and downloading container artifacts.

For an overview of writing destination data to container artifacts, you can also view the video tutorial.

Indicating to write destination data to container artifacts

Under Destination Settings, to indicate to write the destination data to container artifacts, click Container Repository.

For a Structural instance that is deployed on Docker, unless you set up a separate Kubernetes cluster, the Container Repository option is hidden.

You can switch between writing to a database server and writing to a container repository at any time. Structural preserves the configuration details for both options. When you run data generation, it uses the currently selected option for the workspace.

From the Database Image dropdown list, select the image to use to create the container artifacts.

Select an image version that is compatible with the version of the database that is used in the workspace.

For a MySQL workspace, you can provide a customization file that helps to ensure that the temporary destination database is configured correctly.

To provide the customization details:

1. Toggle Use customization to the on position.

2. In the text area, paste the contents of the customization file.

To provide the location where Structural publishes the container artifacts:

1. In the Registry field, type the path to the container registry where Structural publishes the data volume.

   Do not include the HTTP protocol, such as http:// or https://.

2. In the Repository Path field, provide the path within the registry where Structural publishes the data volume.

   For a Google Artifact Registry (GAR) repository, the path format is PROJECT-ID/REPOSITORY/IMAGE.

You next provide the credentials that Structural uses to read from and write to the registry.

When you provide the registry, Structural detects whether the registry is from Amazon Elastic Container Registry (Amazon ECR), Google Artifact Registry (GAR), or a different container solution.

It displays the appropriate fields based on the registry type.

For a registry other than an Amazon ECR or a GAR registry, the credentials can be either a username and access token, or a secret.

In general, the credentials must be for a user that has read and write permissions for the registry.

The secret is the name of a Kubernetes secret that lives on the pod that the Structural worker runs on. The secret type must be kubernetes.io/dockerconfigjson. The Kubernetes documentation provides information on .

To use a username and access token:

1. Click Access token.

2. In the Username field, provide the username.

3. In the Access Token field, provide the access token.

To use a secret:

1. Click Secret name.

2. In the Secret Name field, provide the name of the secret.

For ACR, the provided credentials must be for a service principal that has sufficient permissions on the registry.

For Structural, the service principal must at least have the permissions that are associated with the.

For a GAR registry, you upload a service account file, which is a JSON file that contains credentials that provide access to Google Cloud Platform (GCP).

The associated service account must have the Artifact Registry Writer role.

For Service Account File, to search for and select the file, click Browse.

For an Amazon ECR registry, you can either:

• Provide the AWS access and secret key that is associated with the IAM user that will connect to the registry

• Provide an assumed role

• (Self-hosted only) Use the credentials configured in the Structural environment settings TONIC_AWS_ACCESS_KEY_ID and TONIC_AWS_SECRET_ACCESS_KEY.

To provide an AWS access key and secret key:

1. Click Access Keys.

2. In the AWS Access Key field, enter an AWS access key that is associated with an IAM user or role.

3. In the AWS Secret Key field, enter the secret key that is associated with the access key.

4. Optionally, in the AWS Session Token

To provide an assumed role:

1. Click Assume Role.

2. In the Role ARN field, provide the Amazon Resource Name (ARN) for the role.

3. In the Session Name field, provide the role session name. If you do not provide a session name, then Structural automatically generates a default unique value. The generated value begins with TonicStructural.

For the assumed role, Structural generates the external ID that is used in the assume role request. Your role’s trust policy must be configured to condition on your unique external ID.

Here is an example trust policy:

On a self-hosted instance, to use the credentials configured in the environment settings, click Environment Variables.

On a self-hosted instance, to use the AWS credentials from the EC2 instance, click Instance Profile.

The IAM user must have permission to list, push, and pull images from the registry. The following example policy includes the required permissions.

For additional security, a repository name filter allows you to limit access to only the repositories that are used in Structural. You need to make sure that the repositories that you create for Structural match the filter.

For example, you could prefix Structural repository names with tonic-. In the policy, you include a filter based on the tonic- prefix:

In the Tags field, provide the tag values to apply to the container artifacts. You can also change the tag configuration for individual data generation jobs.

Use commas to separate the tags.

A tag cannot contain spaces. Structural provides the following built-in values for you to use in tags:

• {workspaceId} - The identifier of the workspace.

• {workspaceName} - The name of the workspace.

• {timestamp} - The timestamp when the data generation job that created the artifact completed.

For example, the following creates a tag that contains the workspace name, job identifier, and timestamp:

{workspaceName}_{jobId}_{timestamp}

To also tag the artifacts as latest, check the Tag as "latest" in your repository checkbox.

You can also optionally configure custom resource values for the Kubernetes pods. You can specify the ephemeral storage, memory, and CPU millicores.

To provide custom resources:

1. Toggle Set custom pod resources to the on position.

2. Under Storage Size:

   1. In the field, provide the number of megabytes or gigabytes of storage.