Responding to schema changes

Schema changes include:

• Sensitive schema changes, which if not addressed can result in data leakage. These changes include new tables and columns, and changes to data types.

• Notifications, which Structural can handle automatically during each data generation. These include removed tables and columns.

Under Block Data Generation on Schema Changes, select how Structural responds when there are unaddressed changes to the database schema.

The options are:

• Do Not Block - With this option, schema changes never block data generation. Structural ignores sensitive schema changes, and automatically handles notifications during data generation.

• Block On Sensitive Changes - Indicates to only block data generation if there are sensitive schema changes. Structural automatically handles notifications during data generation.

• Block On All Changes - For this option, if there are any unaddressed schema changes at all, either sensitive changes or notifications, data generation fails.

For more information, go to Viewing and resolving schema changes.

When you go to Tonic Structural for the first time, you create an account. How you create an account depends on the type of user you are.

A new Structural user can be one of the following:

• Free trial users use Structural Cloud to explore and experiment with Structural before they decide whether to purchase it.

• Self-hosted instances are installed on-premises. The customer administers the Structural users.

• New users are added to existing organizations based on their email domain.

Tonic Structural data generation combines sensitive data detection and data transformation to create safe, secure, and compliant datasets.

The Structural data generation workflow involves the following steps:

You can also view this .

1. To get started, you . When you create a workspace, you identify the type of source data, such as PostgreSQL or MySQL, and establish the connections to the source database and the destination location. The source database contains the original data that you want to synthesize. The destination location is where Structural stores the synthesized data. It might be a database, a storage location, a container repository, or an Ephemeral database snapshhot.

2. Next, you . The sensitivity scan identifies columns that contain sensitive data. These columns need to be protected by a generator.

3. Based on the sensitivity scan results, you configure the data generation. The configuration includes:

   • The table mode controls the number of rows and columns that are copied to the destination database.

   • You can make adjustments to the initial sensitivity assignments. For example, you can mark additional columns as sensitive that the initial scan did not identify as sensitive.

   • To protect the data in a column, especially a sensitive column, you assign a generator to it. The generator replaces the source value with a different value in the destination database. For example, the generator might scramble the characters or assign a random value of the same type.

4. After you complete the configuration, you . The data generation job uses the configured table modes and generators to transform the data from the source database and write the transformed data to the destination location. You can track the job progress and view the job results.

Every workspace includes the following settings to identify the workspace and to select the type of data connector.

Fields to identify the workspace

All workspaces have the following fields that identify the workspace:

1. In the Workspace name field, enter the name of the workspace.

2. In the Workspace description field, provide a brief description of the workspace. The description can contain up to 200 characters.

3. In the Tags field, provide a comma-separated list of tags to assign to the workspace. For more information on managing tags, go to Assigning tags to a workspace.

Connection type

Under Connection Type, select the type of data connector to use for the workspace data. You cannot change the connection type on a child workspace.

The Basic and Professional licenses limit the number and type of data connectors you can use.

• A Basic instance can only use one data connector type, which can be either PostgreSQL or MySQL. After you create your first workspace, any subsequent workspaces must use the same data connector type.

• A Professional instance can use up two different data connector types, which can be any type other than Oracle or Db2 for LUW. After you create workspaces that use two different data connector types, any subsequent workspaces must use one of those data connector types.

If the database that you want to connect to isn't in the list, or you want to have different database types for your source and destination database, contact [email protected].

When you select a connector type, Structural updates the view to display the connection fields used for that connector type. The specific fields vary based on the connector type.

The Tonic Structural synthetic data platform combines sensitive data detection and data transformation to allow users to create safe, secure, and compliant datasets.

Common Structural use cases include creating staging and development environments, and trying out a new cloud provider without complex data agreements.

Structural allows you to reduce bug counts, shorten testing life cycles, and share data with partners, all while helping to ensure security and compliance with the latest regulations, from GDPR to CCPA.

You can use the Structural API to integrate with CI/CD pipelines or to create automated processes that ensure that the generated data is available on demand.

The workspace settings for a new workspace (New Workspace view) or edited workspace (Workspace Settings tab) provide information about the workspace and its data.

The Tonic Structural platform creates safe, realistic datasets to use in staging environments or for local development. The Structural web application and API can be used by engineers, data analysts, or security experts.

Structural connects to source databases that contain sensitive data such as personally identifiable information (PII) or protected health information (PHI). To protect that data, Structural transforms the sensitive values and then writes the transformed data to a destination location.

New to Structural? Review the Tonic Structural workflow overview. For information on how to create a Structural account and start a Structural free trial, go to Getting started with the Structural free trial.

Want to know what's in the latest Structural releases? Go to the Tonic Structural release notes.

The Structural application heading includes a feature updates icon, which displays a summary of the newest features, and includes a link to the Structural release notes.

Connect to your data

Configure and generate transformed data

Manage a self-hosted Tonic Structural instance

Need help with Structural? Contact [email protected].

Self-hosted Tonic Structural instance

You can .

For a self-hosted instance, Structural provides administrator tools that allow you to and .

You can to customize your instance.

On a self-hosted instance, based on your , you have access to the full set of supported data connectors.

Structural Cloud

Structural Cloud is our secure hosted environment. On Structural Cloud, Tonic.ai handles monitoring Structural services and updating Structural.

For , Structural Cloud only supports Okta.

Structural Cloud does not include:

• . Structural Cloud uses a single configuration.

• Access to the following data connectors:

Structural Cloud also supports a pay-as-you-go plan, where free trial users can move on to set up a monthly subscription. For more information, go to .

Each Structural Cloud user belongs to a Structural Cloud organization, which is determined either by the user's email domain or by a workspace invitation. Structural Cloud users do not have any access to workspaces or users from other organizations.

Each free trial user is in a separate organization, along with any users that they invite to have access to a free trial workspace.

For information about Structural Cloud organizations, go to .

The Account Admin permission set allows a Structural Cloud user to manage organization users and workspaces. For information about granting access to the Account Admin permission set, go to .

A Tonic Structural implementation can involve the following roles - from those who set up the Structural environment to the consumers of the data that Structural processes.

Note that these roles are not related to role-based access (RBAC) within Structural, which is managed using permission sets.

Infrastructure engineers

For self-hosted instances of Structural.

Infrastructure engineers set up the Structural application and its relevant dependencies. They are typically DevOps, Site Reliability Engineering (SRE), or Kubernetes cluster administrators.

Infrastructure engineers perform the following Structural-related tasks:

• Ensure that the proper infrastructure is ready for Structural installation based on the deployment checklist.

• Follow the installation instructions. Works with Tonic.ai support as needed.

• Perform routine maintenance of Structural and the Structural environment. Updates Structural and its dependencies as needed.

• Create Structural-processed data pipelines for development and testing workflows.

Database administrators

For both self-hosted instances of Structural and Structural Cloud.

Database administrators integrate Structural into your data architecture to support Structural data connectors.

They ensure that source databases are available to Structural, and that Structural can write to destination databases.

Database administrators perform the following Structural-related tasks:

• Set up the required Structural access to source databases.

• Set up destination databases for Structural to write transformed data to.

Structural users

Structural users are the actual users of the Structural application.

Depending on the use case, Structural users might be compliance analysts, DevOps, or data engineers.

Tonic users perform the following Structural-related tasks:

• Use the Structural data generation workflow to configure the logic used to transform the source data and to generate the transformed data.

• Work with data consumers to produce usable data.

Data consumers

Data consumers are the end users of transformed destination data.

They are typically QA testers, developers, or analysts.

Data consumers perform the following Structural-related tasks:

• Validate the usability of the destination data.

• Provide guidance on application-specific requirements for data.

Security and compliance

Security and compliance specialists ensure and validate that the data that Structural produces meets expectations, and that Structural is compliant with other security-related processes.

Security and compliance specialists perform the following Structural-related tasks:

• Provide guidance on what data is sensitive.

• Sign off on proposed approaches to mask sensitive data.

• Approve data access and permissions.

A Tonic Structural workspace provides a context within which to configure and generate transformed data.

A workspace represents a path between the source data and the transformed output data. For example, postgres-prod-copy to postgres-staging.

A workspace includes:

• Where to find the source data to transform during data generation

• Where to write the transformed data

• The rules for the transformation

Manage workspaces

Workspace details and tools

After you select the connector type, you configure:

• Where to find the source data

• Where to write the data generation output

Source database connection

For data connectors that connect to a database, the Source Settings section provides connection information for the source database.

You cannot change the source data configuration for a .

For information about the source connection fields for a specific data connector, go to the workspace configuration topic for that .

Upsert configuration

For data connectors that support upsert, the workspace configuration includes an Upsert section to allow you to enable and configure upsert. Upsert adds and updates rows in the destination database, but keeps all other existing rows intact.

If you enable upsert, then you cannot write output to an Ephemeral database or to a container repository. You must write the output to a destination database.

For more information, go to .

Destination data location

For data connectors that connect to a database, the Destination Settings section provides information about where and how Structural writes the output data from data generation.

Depending on the data connector type, you might be able to write to either:

• Destination database - Writes the output data to a destination database on a database server.

• Ephemeral snapshot - Writes the output data to a Tonic Ephemeral user snapshot.

• Container repository - Writes the output data to a data volume in a container repository.

Destination database

When you write the output to a destination database, the destination database must be of the same type as the source database.

Structural does not create the destination database. It must exist before you generate data.

In Destination Settings, you provide the connection information for the destination database. For information about the destination database connection fields for a specific data connector, go to the workspace configuration topic for that .

If available, the Copy Settings from Source allows you to copy the source connection details to the destination database, if both databases are in the same location. Structural does not copy the connection password.

Tonic Ephemeral snapshot

Tonic Ephemeral is a separate Tonic.ai product that allows you to create temporary databases to use for testing and demos. For more information about Ephemeral, go to the .

If Ephemeral supports your workspace database type, then you can write the destination data to a snapshot in Ephemeral. For data larger than 10 GB, this option is recommended instead of writing to a container repository.

From Ephemeral, you can use the snapshot to start new Ephemeral databases.

For more information, go to .

Container repository

Some data connectors allow you to write the transformed data to a data volume in a container repository instead of to a database server.

You can use the resulting data volume to create a database in Tonic Ephemeral. If you do plan to use the data to start an Ephemeral database, and the size of the data is larger than 10 GB, then the recommendation is to write the data to an Ephemeral user snapshot instead.

For more information, go to .

Testing database connections

When you provide connection details for a database server, Structural provides a Test Connection button to test the connection, and verify that Structural can use the connection details to connect to the database. Structural uses the connection details to try to reach the database, and indicates whether it succeeded or failed. We strongly recommend that you test the connections.

The TONIC_TEST_CONNECTION_TIMEOUT_IN_SECONDS determines the number of seconds before a connection test times out. You can configure this setting from the Environment Settings tab on Structural Settings. By default, the connection test times out after 15 seconds.

File connector source and destination data

A workspace uses files as its source data and produces transformed versions of those files as its output.

For file connector workspaces, the File Location section indicates where the source files are obtained from - either a local file system or a cloud storage solution (Amazon S3 or Google Cloud Storage).

When the files come from cloud storage, the Output Location section indicates where to write the transformed files. You must also provide the cloud storage connection credentials.

For more information, go to .

Every workspace has an owner. The owner is always a user.

The user who creates the workspace is automatically the owner of the workspace.

By default, the workspace owner is assigned the built-in Manager workspace permission set. On Enterprise instances, you can choose a different workspace permission set to assign to all workspace owners.

You cannot remove that permission set from the workspace owner.

You can transfer a workspace to a different owner. The new owner is assigned the owner permission set. If the previous owner does not otherwise have access to the owner permission set, then that permission set is removed.

To transfer workspace ownership:

1. To transfer ownership of a single workspace, from the workspace actions menu, select Transfer Ownership.

2. To transfer ownership of multiple workspaces:

   1. Check the checkbox for each workspace to grant access to.

   2. From the Actions menu, select Transfer Ownership.

3. On the transfer ownership panel, from the User dropdown list, select the new owner.

4. If you are the current owner of the workspace, then to grant yourself non-owner access after you transfer the ownership:

   1. Toggle Receive access to workspace to the on position.

   2. Select the workspace permission set to assign to yourself.

5. Click Transfer Ownership.

You can associate custom tags with each workspace. Tags can help to organize and provide a quick glance into the workspace configuration.

Tags are accessible to every user that has access to the workspace.

Tags are stored in the workspace JSON, and are included in the workspace export. You can also use the API to get access to tags.

Managing tags from workspace settings

You can add and edit tags in the Tags field on the New Workspace and Workspace Settings views.

• To add tags, enter a comma-separated list of the tags to add.

• To remove a tag, click its delete icon.

Managing tags from Workspaces view

You can also manage tags directly from Workspaces view.

Assigning tags

To add tags to a workspace that does not currently have tags:

1. Hover over the Tags column for the workspace.

2. Click Add Tags.

3. In the tag input field, type a comma-separated list of tags to apply.

4. Press Enter.

Editing the assigned tags

To edit the assigned tags:

1. Click the Tags column for the workspace.

2. In the tag input field, to remove tag, click its delete icon.

3. To add tags, type a comma-separated list of the tags to add.

4. To save the tag changes, press Enter.

What is the minimum required screen width for the Tonic Structural application?

The minimum screen width is 1120 pixels.

How do you connect to a local database when running Structural in a Docker container locally?

If the locally running database that you want to connect to runs in a Docker container:

1. Run: docker inspect

2. In the networks section of the results, find the Gateway IP address. Use this IP address as the server address in Structural.

If the locally running database does NOT run in a container, but runs on the machine, then:

• On Windows or Mac, use host.docker.internal.

• On Linux, use 172.17.0.1, which is the IP address of the docker0 interface.

I allowlist access to my database. What are your static IP addresses?

If you use Structural Cloud, and your database only allows connections from allowlisted IP addresses, then you need to allowlist Structural static IP addresses.

This is not required for self-hosted instances of Structural.

United States-based instance

For the United States-based instance (app.tonic.ai), the static IP addresses are:

• 54.92.217.68

• 52.22.13.250

The following IP addresses are used if needed for scaling or failover:

• 44.215.74.226

• 3.232.203.148

• 3.224.2.189

• 44.230.136.147

• 44.230.79.194

Europe-based instance

For the Europe-based instance (app-de.tonic.ai), the static IP addresses are:

• 18.159.127.160

• 3.69.249.144

The following IP addresses are used if needed for scaling or failover:

• 18.159.179.95

• 3.120.214.225

• 3.75.12.1

• 16.16.71.42

• 16.170.51.237

I allowlist network calls. What do I need to allowlist?

URLs for telemetry sharing

The URL https://telemetry.tonic.ai/ is used for our Amplitude telemetry.

https://telemetry.tonic.ai/logs is used specifically for log sharing.

Allowlist https://telemetry.tonic.ai/ or the following IP addresses:

• 75.2.74.76

• 99.83.246.105

Telemetry sharing is required. These metrics are valuable for us as we debug, make product roadmaps, and determine feature viability.

No customer data is included. For more information about the specific telemetry data that we collect, go to Data that Tonic.ai collects.

For more information on how to verify that telemetry is shared, go to Verifying and enabling telemetry sharing.

URLs for Structural version information

To support the one-click update option, Structural needs to be able to retrieve information about the latest Structural version.

For more information, go to .

How do I check my current version of Structural?

Click your user image at the top right. The menu includes the Tonic version.

How should we provision our source database?

We recommend that you use a static copy of your production database that was restored from a backup.

If that's not possible, consider the following when you connect Structural to your source data:

• Structural cannot guarantee referential integrity of the output data if the source database is written to while data is generated. For this reason we recommend that you connect to a static copy of production data.

• Read replicas and fast followers can be problematic for Structural because of how long it takes some queries to run. Read replicas tend to have short query timeout limits, which causes the queries to time out. Read replicas also reflect recent writes, which means that we cannot guarantee the referential integrity of the output.

What data does Tonic.ai collect from Structural?

For details about the types of data that Tonic.ai does and does not collect, go to Data that Tonic.ai collects.

Use these tutorial videos to learn more about how to use Tonic Structural.

Tonic Structural 101

Provides an overview of the Structural workflow and how to use Structural to generate de-identified data. For more information, go to Structural data generation workflow.

Creating a Structural workspace

Provides an overview of what a Structural workspace is and how to create a new Structural workspace. For more information, go to Managing workspaces.

Sensitivity detection and generator recommendations

Provides an overview of how Structural detects sensitive values and how you can apply recommended generators to the detected values.

Managing workspace access

Provides an overview of workspace owners, permissions, and permission sets. Explains how to share and transfer ownership of a workspace. For more information, go to Managing access to workspaces.

Structural generators overview

Identifies the types of generators and transformations that you can use in Structural, and explains how to assign a generator to a column. For more information, go to Generator information.

Generator presets

Provides an overview of generator presets. Includes how to create and update them, and how to track where each generator preset is used. For more information, go to Managing generator presets.

File connector overview

Provides an overview of the file connector and how to manage file groups in a file connector workspace. For more information, go to File connector.

Generating data with consistency

Provides an overview of the consistency generator property and how it works. For more information, go to Enabling consistency.

Using Document View to configure JSON columns

Provides an overview of how to enable Document View for a JSON column and how to use it to configure generators for JSON fields.

Subsetting your data

Provides an overview of subsetting, how it is configured, and how Structural uses the configuration to generate a subset. For more information, go to Subsetting data.

Upsert data generation

Provides an overview of upsert data generation. Includes how it works and how to enable and run it for a workspace. For more information, go to Enabling and configuring upsert.

Writing destination data to a container repository

Provides an overview of how to write destination data to a container repository instead of a database server. For more information, go to Writing output to a container repository.

Creating a workspace

When you create a new workspace, you can either:

• Create a completely new workspace.

• Create a copy of an existing workspace. The copy initially uses the configuration from the original workspace. After the copy is created, it is completely independent from the original workspace.

• Create a child of an existing workspace. Child workspaces inherit configuration from the parent workspace. They continue to be updated automatically when the parent workspace is updated. For more information, go to About workspace inheritance.

You can also view this video overview of how to create a workspace.

Creating a completely new workspace

To create a completely new workspace, on Workspaces view, click Create Workspace > New Workspace.

Creating a copy of a workspace

To create a workspace based on an existing workspace, either:

• On the workspace management view of the workspace to copy, from the workspace actions menu, select Duplicate Workspace.

• On Workspaces view, click the actions menu for the workspace, then select Duplicate Workspace.

When you create a copy of a workspace, the copy initially inherits the following workspace configuration:

• Source and destination database connections

• Sensitivity designations, including manual designations that override the sensitivity scan results

• Table mode assignments

• Generator configuration

• Subsetting configuration

• Post-job scripts

Creating a child workspace

You can create a workspace that is a child of an existing workspace. You cannot create a child workspace of another child workspace.

The parent workspace must have a source database configured. You cannot create a child workspace from a workspace that uses the Databricks, Spark (Amazon EMR or self-managed Spark cluster), or MongoDB data connector.

To create a child workspace, either:

• On Workspaces view:

  • Click Create Workspace > Child Workspace.

  • Click the actions menu for the parent workspace, then select Create Child Workspace.

• On the workspace management view, from the workspace actions menu, select Create Child Workspace.

On the New Workspace view, under Child Workspace, Parent Workspace identifies the parent workspace.

If you used the Create Workspace > Child Workspace option to create the child workspace, then Parent Workspace is not populated. From the Parent Workspace dropdown list, select the parent workspace for the new child workspace.

If you selected the child workspace option for a specific workspace, then Parent Workspace is set to that workspace.

If you originally chose to create a completely new workspace, then on the New Workspace view:

1. To change to a child workspace, select Create Child Workspace from the Create a child workspace panel at the right. Structural adds the Child Workspace panel to the New Workspace view.

2. From the Parent Workspace dropdown list, select the parent workspace for the new child workspace.

Editing a workspace

To edit the configuration for an existing workspace, either:

• On the workspace management view:

  • On the workspace navigation bar, click Workspace Settings.

  • From the workspace actions menu, select Workspace Settings.

• On Workspaces view, click the actions menu for the workspace, then select Workspace Settings.

Deleting a workspace

You can delete workspaces that you no longer need.

You cannot delete a parent workspace. You must first delete all of its child workspaces.

To delete a workspace:

• On the workspace management view, from the workspace actions menu, select Delete Workspace.

• On the Workspaces view, click the actions menu for the workspace, then select Delete.

Tonic Ephemeral is a separate Tonic.ai product that allows you to create temporary databases to use for testing and demos. For more information about Ephemeral, go to the .

If Ephemeral supports your workspace database type, then you can write the destination data to a snapshot in Ephemeral. You can then use the snapshot to start Ephemeral databases.

To write the transformed data to Ephemeral, under Destination Settings, click Ephemeral Database.

Selecting the Ephemeral instance type

Structural can write the data snapshot to either Ephemeral Cloud or to a self-hosted instance of Ephemeral. By default, Structural writes the data snapshot to Ephemeral Cloud.

All workspaces on the same self-hosted Structural instance or in the same Structural Cloud organization must write to the same instance of Ephemeral. When you change the Ephemeral output configuration in one workspace, it is automatically changed in other workspaces that write to Ephemeral.

Writing output to Ephemeral Cloud

Structural writes the snapshot to the Ephemeral Cloud account for the user who runs the data generation job.

• If that user has an Ephemeral account on Ephemeral Cloud, then Structural uses that account.

• If the user does not have an account, then Structural creates an account for them.

On Structural Cloud, when you save the workspace, if you do not have an Ephemeral Cloud account, then an Ephemeral Cloud account is created for you.

When Structural creates an Ephemeral account, if the user belongs to an existing Ephemeral Cloud organization, then the account is added to the organization. Otherwise, the account is a two-week free trial account.

For a self-hosted Structural workspace, you must provide an API key from an existing Ephemeral Cloud account.

To write a snapshot to Ephemeral Cloud:

1. Click Tonic Ephemeral cloud.

2. If you are on a self-hosted instance of Structural:

   1. In the API Key field, provide an Ephemeral API key from your Ephemeral account.

   2. To test the connection, click Test Connection.

Writing output to self-hosted Ephemeral

When you write to a self-hosted instance of Ephemeral, then you must always provide an Ephemeral API key.

To write the snapshot to a self-hosted instance of Ephemeral:

1. Click Tonic Ephemeral self-hosted.

2. In the API Key field, provide an Ephemeral API key from your Ephemeral account. Structural writes the snapshot to the Ephemeral account that is associated with the API key.

3. In the Tonic Ephemeral URL field, provide the URL to your self-hosted Ephemeral instance.

4. To test the connection, click Test Connection.

Selecting the image for Oracle

For Oracle, you select the base image to use to create the data snapshot.

If you write to Ephemeral Cloud, then you must use the Oracle 23c base image that comes with Ephemeral. This image has the following limitations:

• A maximum of 12GB of user data

• A maximum of 2CPU cores and 2GB of RAM

If you write to a self-hosted instance of Ephemeral, then you can also select a custom image that you created in Ephemeral.

For information about how to create and manage custom images for Oracle, go to .

Configuring advanced settings for the snapshot

If you do not configure any advanced settings, then:

• The snapshot uses the same name as the workspace, and has no description.

• The snapshot size allocation is determined by the source data size.

• Structural discards the temporary Ephemeral database that is created during the data generation.

To change any of these settings, click Advanced settings.

Providing a snapshot name and description

By default, the snapshot name uses the workspace name.

When you run data generation, if a snapshot with the same name already exists in Ephemeral, then Structural overwrites that snapshot with the new snapshot.

Under Advanced settings:

1. In the Snapshot name field, provide the name of the snapshot. The snapshot name can use the following placeholder values to help identify the snapshot:

   • {workspaceName} - Inserts the name of the workspace.

   • {workspaceId} - Inserts the identifier of the workspace.

   • {jobId} - Inserts the identifier of the data generation job that created the snapshot.

   • {timestamp} - Inserts the timestamp when the snapshot was created.

   Including the job ID or timestamp ensures that a data generation job does not overwrite a previous snapshot.

2. Optionally, in the Snapshot description field, provide a longer description of the snapshot.

Setting the pod resources for the snapshot

By default, the resources used for the snapshot are based on the size of the source data.

• For source data that is 25 GB or less, Nano is used.

• For source data larger than 25 GB, Micro is used.

To select a specific option:

1. Toggle Custom pod resources to the on position.

2. From the dropdown list, select the option to use for the combination of vCPUs and memory:

   • Nano - 0.125 vCPU with 0.5 GB RAM

   • Micro - 0.5 vCPU with 2 GB RAM

   • Small - 1 vCPU with 4 GB RAM

   • Medium - 2 vCPU with 8 GB RAM

   • Large - 4 vCPU with 16 GB RAM

Setting the size allocation for the snapshot

By default, the Ephemeral size allocation for the snapshot is based on the size of the source data.

To instead provide a custom data size allocation, under Advanced settings:

1. Toggle Custom data size allocation to the on position.

2. In the field, enter the size allocation in gigabytes.

Indicating whether to keep the temporary Ephemeral database

When Structural creates the Ephemeral snapshot, it creates a temporary Ephemeral database.

By default, Structural deletes that database when the data generation is complete.

To instead keep the database, under Advanced settings, toggle Keep database active in Tonic Ephemeral after data generation to the on position.

In Ephemeral Cloud, by default, databases are publicly accessible. To limit database access, you can configure Ephemeral Cloud with an IP allowlist for your organization. For more information, go to in the Ephemeral documentation.

Providing a customization file for MySQL or PostgreSQL

For a MySQL or PostgreSQL workspace, you can provide a customization file that helps to ensure that the temporary Ephemeral database is configured correctly.

To provide the customization details:

1. Toggle Use custom configuration to the on position.

2. In the text area, paste the contents of the customization file.

From the User Settings view, you can manage settings for your individual Tonic Structural account.

To display the User Settings view:

1. Click your user image at the top right.

2. In the menu, click User Settings.

The User Settings view includes options to:

• Configure your user image.

• View and copy your organization identifier.

• Configure email notifications for column comments.

• Generate and manage API tokens.

• Change your Structural password (if your Structural instance does not use SSO).

• Delete your Structural account.

Choosing your user image

You can select an image to associate with your account. The image is displayed next to your name and email address throughout Structural.

If your instance uses Google or Azure single sign-on (SSO) to manage Structural users, then by default your Structural account image is the image from the SSO.

Otherwise, the default image displays your initials.

To change your user image, click Upload, then select the image file.

Viewing and copying your organization identifier

Below your user image file name is the identifier of the organization that your account belongs to.

To copy the identifier, click the copy icon.

Configuring notifications for column comments

Structural allows users to provide comments on columns. You can do this from Privacy Hub and Database View.

From the Comment Notification Settings section of User Settings, you can configure when to receive email notifications for comments.

The available options are:

• I am an owner, editor, auditor, or am being replied to This is the default option. You receive email notifications when comments are made on columns in a workspace that you are an owner, editor, or auditor for. You also receive an email notification when someone replies to a comment that you made.

• I am @ mentioned You only receive an email notification if someone specifically mentions you in a comment.

• Never You never receive email notifications for column comments.

Generating and managing API tokens

Before you can use the Structural API, you must create an API token. From the User API Tokens section of the User Settings view, you can create and manage API tokens.

Creating an API token

To create an API token:

1. Click Create Token.

2. On the Create New Token dialog, enter a name for the new token.

3. Click Confirm.

In the list, the new token displays as clear text. To copy the new token, click the copy icon next to the token.

The new token text and copy icon only display during the current session. After that, Structural masks the token and removes the copy icon.

Revoking an API token

To revoke a token, click the Revoke option for the token.

Changing your Structural password

If your Structural account is not managed using SSO, then from User Settings, you can change your Structural password.

If your Structural instance uses SSO to manage users, then your user credentials are managed in the SSO system. You cannot change your user password in Structural.

Under Password Change, to change your Structural password:

1. In the Old Password field, type your current Structural password.

2. In the New Password field, type your new Structural password.

3. In the Repeat New Password field, type your new Structural password again.

4. Click Confirm.

Deleting your Structural account

From User Settings, you can delete your Structural account. If your instance uses SSO to manage users, then deleting your account only affects your access to Structural.

You cannot delete your Structural account if you are the owner of a workspace for which other users are granted access. Before you can delete your Structural account, you must either:

• Revoke access from other users.

• Transfer ownership to a different user.

To delete your Structural account, click Delete Account.

When you delete your account, you are logged out of Structural.

Tonic Structural uses its sensitivity scan to identify source data columns that contain sensitive information. The scan ignores truncated tables.

The sensitivity scan identifies Structural's built-in sensitivity types. It also looks for custom types that you define.

You can also manually mark a column as sensitive or not sensitive.

From Database View, you can add comments to columns. For example, you might use a comment to explain why you selected a particular generator or marked a column as sensitive or not sensitive.

Creating a new comment

If a column does not have any comments, then to add a comment:

1. In the Applied Generator column, click the comment icon.

2. In the comment field, type the comment text.

3. Click Comment.

Responding to existing comments

When a column has existing comments, the comment icon is green. To add comments:

1. Click the comment icon. The comments panel shows the previous comments. Each comment includes the comment user.

2. In the comment field, type the comment text.

3. Click Reply.

The algebraic generator identifies the algebraic relationship between three or more numeric values and generates new values to match. At least one of the values must be a non-integer.

If a relationship cannot be found, then the generator defaults to the Categorical generator.

This generator can be linked with other Algebraic generators.

Characteristics

How to configure

To configure the generator, from the Link To dropdown list, select the columns to link this column to. You can select other columns that are assigned the Algebraic generator.

You must select at least three columns.

The column values must be numeric. At least one of the columns must contain a value other than an integer.

If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

During sensitivity scans and schema change scans, Tonic Structural identifies groups of similar columns.

To identify similar columns, Structural uses a text embedding model to calculate the semantic similarity between any two column names in the database. When a column name's semantic similarity to the name of a given column is above a specified threshold, then the column is similar to the given column.

If a column has similar columns, then the Applied Generator column contains an icon that includes the count of similar columns.

By default, the similar columns icon is hidden. To display the similar columns icon, hover over the column row.

When you assign a generator to a column, the similar columns icon for that column remains visible during your current session.

When you click the similar columns icon, Structural displays a panel with an option to filter the list to display the current column and its similar columns. To apply the filter, click Filter.

The similar columns filter is applied, and other column filters are removed. Table filters remain in place.

For each column on Database View, you can display a sample list of the column values.

For columns that have an assigned generator, the sample shows both the current values and the possible values after the generator is applied.

To display the sample values, in the Column column, click the magnifying glass icon.

If the generator is Passthrough, then the sample data panel contains only Original Data.

If a different generator is assigned, then the sample data panel contains both Original Data and Protected Output.

Workspaces view lists the workspaces that you have access to. To display Workspaces view, in the Tonic Structural heading, click Workspaces.

How the workspace list is displayed

The workspace list contains:

• Workspaces that you own

• Workspaces that you are granted access to

If you have the global permission Copy any workspace or Manage user access to Tonic and to any workspace, then list includes all of the workspaces.

The Permissions column lists the workspace permission sets that you are granted in each workspace. The permission sets include both permission sets that were granted to you directly as a user, and permission sets that were granted to an SSO group that you are a member of.

always display under their parent workspace. The list only includes child workspaces that you have access to. If you have access to a child workspace, but not to its parent workspace, then the parent workspace is grayed out. You cannot select it.

Filtering the workspace list

You can filter the workspaces based on the following information:

• Name - In the filter field, begin to type text that is in the name of the workspaces to display in the list.

• Owner - From the Filter by Owner dropdown list, select the owner of the workspaces to display in the list.

• Database type - From the Filter by Database Type dropdown list, select the type of database for the workspaces to display in the list.

• Generation status - In the Generation Status column heading, click the filter icon. Check the checkbox next to the generation status values for the workspaces to display in the list.

• Tags - In the Tags column heading, click the filter icon. By default, the workspaces are not filtered by tag, and all of the checkboxes are unchecked. To only include workspaces that have specific tags, check the checkbox next to each tag to include. To uncheck all of the selected tags, click Reset Tags. When you filter by tag, Structural checks whether each workspace contains any of the selected tags.

• Permissions - In the Permissions column heading, click the filter icon. You can check and uncheck checkboxes to include or exclude specific permission sets. For example, you can filter the list to only display workspaces for which the Editor permission set is granted either to you or to an SSO group that you belong to. For users that have the global permission Copy any workspace, the Permissions filter panel also contains an Any permissions checkbox. By default, Any permissions is unchecked, and the list includes workspaces for which you are not assigned any workspace permission sets. To display all of the workspaces for which you have any assigned workspace permission sets, check Any permissions. If you filter the list based on a specific permission set, to clear the filter and show all workspaces for which you have any permission set, check Any permissions. To display all workspaces, including workspaces that you do not have any permissions for, uncheck Any permissions.

You can combine different filters. For example, you can filter the list to only include workspaces that use PostgreSQL and for which the generation status is Canceled or Failed.

Child workspaces always display under their parent workspace, even if the parent workspace does not match the filter.

Sorting the workspace list

You can sort the workspace list by name, status, or owner.

By default, the list is sorted alphabetically by name.

To sort by a column, click the column heading. To reverse the order of the sort, click the column heading again.

Child workspaces always display under their parent workspace. The child workspaces are sorted within the parent.

Workspace details on Workspaces view

Workspaces view provides the following information about each workspace:

• Name - Contains the name and database type for the workspace. To view the workspace description, hover over the name.

• Generation status - The status for the most recent generation job. To display the job details for the job, click the job status. To display more details about the date, time, and duration for the job, hover over the generation timestamp. If a job failed recently, you are given additional information about how long this job has been failing (the date of the first failure occurrence among a continuous series of failures).

• Schema changes - Indicates whether Structural detected changes to the source database schema. If there are changes, the column shows the number of changes. Hover over the column value to display additional details, and to navigate to the Schema Changes view. Go to .

• Tags - The tags that are assigned to the workspace.

• Permissions - The permission sets that are assigned to you for the workspace.

• Owner - The name and email address of the workspace owner.

Getting access to workspace tools and actions

Displaying the workspace management view

On Workspaces view, when you click the workspace name, the for the workspace is displayed. The Privacy Hub tab is selected.

The Name column also provides access to a menu of workspace configuration options. When you select an option, the is displayed, open to the view for the selected option.

Options column

The last column in the workspaces list provides additional workspace options:

• Subsetting icon - Displays the subsetting configuration for the workspace. Go to .

• Post-job actions icon - Displays the post-job actions for the workspace. For more information, go to and .

• Actions menu - Provides access to additional options.

Actions menu for bulk actions

The Actions menu at the top left of the workspaces list allows you to to perform bulk actions on multiple workspaces. It is enabled when you check one or more of the checkboxes in the first column of each row. The Actions menu provides options for the selected workspaces.

Your organization might use a secrets manager to secure credentials, including database connection credentials.

For data connector credentials, you can configure a set of available secrets managers. In the workspace configuration, users can then select a secret name from a secrets manager.

Supported secrets manager tools and formats

Structural currently supports AWS Secrets Manager.

Structural only supports secrets that store passwords. For AWS Secrets Manager, the passwords must be in one of the following formats:

• String

• JSON

The JSON must contain a map of key-value pairs. It can either:

• Contain a single key for which the value is the password in plaintext.

• Contain a key that is labeled either password or pw, for which the value is the password in plaintext.

Viewing the secrets manager list

To display the list of secrets managers, on Structural Settings view, click Secrets Manager.

Working with secrets managers

Creating a secrets manager

To create a secrets manager:

1. On the Secrets Manager tab, click Add Secrets Manager.

2. On the Create Secrets Manager panel, in the Name field, provide a name to use to identify the secrets manager. Secrets manager names must be unique. The name is used in the secrets manager dropdown list on the workspace settings view.

3. From the Type dropdown list, select the secrets manager product. Structural currently supports AWS Secrets Manager.

4. Configure the credentials to use to connect to the secrets manager.

5. Click Save.

Editing an existing secrets manager

For an existing secrets manager, you can change the name and the credentials configuration.

You cannot change the type.

To edit an existing secrets manager:

1. In the secrets manager list, click the edit icon for the secrets manager.

2. On the Edit Secrets Manager panel, update the configuration.

1. Click Save.

Deleting a secrets manager

When you delete a secrets manager, it is removed from the workspace database connections that use it. Structural is no longer able to connect to those databases.

To delete a secrets manager:

1. In the secrets manager list, click the delete icon for the secrets manager.

2. On the confirmation panel, click Delete.

Providing credentials for AWS Secrets Manager

Required AWS Secrets Manager permissions

The AWS Secrets Manager credentials that you provide must have the following permissions:

• secretsmanager:ListSecrets

• On each secret to use, secretsmanager:GetSecretValue

• On the encryption key for secrets that are encrypted with a customer managed key (CMK), kms:Decrypt

Here is an example policy that grants the required Secrets Manager permissions:

Selecting the source of the credentials

For AWS Secrets Manager, under Authentication, select the source of the credentials:

• Environment - Only available on self-hosted instances. Indicates to use either:

  • The credentials for the AWS Identity and Access Management (IAM) role on the host machine.

  • The credentials set in the following :

    • TONIC_AWS_ACCESS_KEY_ID - An AWS access key that is associated with an IAM user or role

    • TONIC_AWS_SECRET_ACCESS_KEY - The secret key that is associated with the access key

    • TONIC_AWS_REGION - The AWS Region to send the authentication request to

• Assumed role - Indicates to use the specified assumed role.

• User credentials - Indicates to use the provided user credentials.

Providing an assumed role

To provide an assumed role, click Assume Role, then:

1. In the Role ARN field, provide the Amazon Resource Name (ARN) for the role.

2. In the Session Name field, provide the role session name. If you do not provide a session name, then Structural automatically generates a default unique value. The generated value begins with TonicStructural.

3. In the Duration (in seconds) field, provide the maximum length in seconds of the session. The default is 3600, indicating that the session can be active for up to 1 hour. The provided value must be less than the maximum session duration that is allowed for the role.

4. From the AWS Region dropdown list, select the AWS Region to send the authentication request to.

Structural generates the external ID that is used in the assume role request. Your role’s trust policy must be configured to condition on your unique external ID.

Here is an example trust policy:

Providing AWS user credentials

To provide the credentials, click User Credentials, then:

1. In the AWS Access Key field, enter the AWS access key that is associated with an IAM user or role.

2. In the AWS Secret Key field, enter the secret key that is associated with the access key.

3. Optional. In the AWS Session Token field, provide the session token to use.

4. From the AWS Region dropdown list, select the AWS Region to send the authentication request to.

Database View provides a complete view of your source database structure and configuration.

To display Database View, either:

• On the workspace management view, in the workspace navigation bar, click Database View.

• On Workspaces view, from the dropdown menu in the Name column, select Database View.

Database View consists of:

• On the left, the list of tables in the source database.

• On the right, the list of columns in those tables.

View table and column information

Configure and comment on columns

A version of the generator that can be used for array values.

This generator replaces letters with random other letters, and numbers with random other numbers. Punctuation and whitespace are preserved.

For example, for the following array value:

["ABC.123", 3, "last week"]

The output might be something like:

["KFR.860", 7, "sdrw mwoc"]

This generator securely masks letters and numbers. There is no way to recover the original data.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator self-consistent.

By default, the generator is not consistent.

If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates a random company name-like string.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator consistent.

By default, the generator is not consistent.

If consistency is enabled, then by default it is self-consistent. To make the generator consistent with another column, from the Consistent to dropdown list, select the column.

When the generator is consistent with itself, then a given source value is always mapped to the same destination value. For example, My Business is always mapped to New Business.

When the generator is consistent with another column, then a given source value in that other column always results in the same destination value for the company name column. For example, if the company name column is consistent with a name column, then every instance of John Smith in the name column in the source database has the same company name in the destination database.

If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Performs a random character replacement that preserves formatting (spaces, capitalization, and punctuation).

Characters are replaced with other characters from within the same Unicode Block. A given source character is always mapped to the same destination character. For example, M might always map to V.

For example, for the following input string:

Miami Store #162

The output would be something like:

Vgkjg Gmlvf #681

Note that for a numeric column, when a generated number starts with a 0, the starting 0 is removed. This could result in matching output values in different columns. For example, one column is changed to 113 and the other to 0113, which also becomes 113.

Character Substitution is similar to , with a couple of key differences. Because Character Substitution always maps the same source character to the same destination character, it is always consistent. It also can be used for unique columns.

In Character Scramble, the character mapping is random, which makes Character Scramble slightly more secure. However, Character Scramble cannot be used for unique columns.

Characteristics

How to configure

If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

This generator can be used to mask columns of latitude and longitude.

The Geo generator divides the globe into grids that are approximately 4.9 x 4.9 km. It then counts the number of points within each grid.

During data generation, each (latitude, longitude) pair is mapped to its grid.

• If the grid contains a sufficient number of points to preserve privacy, then the generator returns a randomly chosen point in that grid.

• If the grid does not contain enough points to preserve privacy, then the generator returns a random coordinate from the nearest grid that contains enough points.

Characteristics

How to configure

To configure the generator:

1. From the Link To dropdown list, select the column to link to this one. You typically assign the Geo generator to both the latitude and longitude column, then link those columns.

2. From the value type dropdown, select whether this column contains a latitude value or a longitude value.

3. If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

You can also manually indicate that a column is sensitive or not sensitive.

For example, the sensitivity scan might incorrectly identify a column as sensitive. Or a column might contain data that you consider sensitive but that does not match a detected sensitivity type.

When you manually change a column from not sensitive to sensitive, Structural marks the sensitivity detection as full confidence.

For information on how to change whether a column is sensitive:

• For Privacy Hub, go to .

• For Database View, go to:

  • For a single column,

  • For multiple selected columns,

• For Table View, go to .

The Structural API also provides .

For document-based data connectors - currently and - Database View and Table View are replaced by Collection View.

"Collection" is the term that Structural uses to refer to MongoDB collections and DynamoDB tables.

Structural also allows you to run collection scans to identify the data structure.

Generates a valid Finnish Personal Identity Code (PIC) that would have been issued during a specific date range.

Characteristics

How to configure

To configure the generator:

1. Under Date Range, set the start and date for the date range to generate the PICs for.

2. Toggle the Consistency setting to indicate whether to make the generator self-consistent. By default, the generator is not consistent.

3. If Structural data encryption is enabled, then to use it for this column, toggle Use data encryption process to the on position.

Uses a single value to mask all of the values in the column.

For example, you can replace every value in a string column with the value String1. Or you can replace every value in a numeric column with the value 12345.

Characteristics

How to configure

To configure the generator, in the Constant Value field, provide the value to use.

The value must be compatible with the field type. For example, you cannot provide a string value for an integer column.

If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates unique alphanumeric strings based on any printable ASCII characters. The length of the source string is not preserved. You can choose to exclude lowercase letters from the generated values.

Characteristics

How to configure

To configure the generator:

1. To exclude lowercase letters from the generated values, toggle Exclude Lowercase Alphabet to the on position.

2. Toggle the Consistency setting to indicate whether to make the generator consistent. By default, the generator is not consistent.

3. If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates NULL values to fill the rows of the specified column.

Characteristics

How to configure

The Null generator has no configuration options.

When you create a workspace, you become the owner of the workspace, and by default are assigned the built-in Manager workspace permission set for the workspace. The Manager permission set provides full access to the workspace configuration, data, and results.

With a Professional or Enterprise license, you can also assign workspace permission sets to other users and to SSO groups. You can also transfer a workspace to a different owner.

If you are granted access to any workspace permission set for a workspace, then you have access to all of the workspace management views for that workspace. However, you can only perform tasks that you have permission for in that workspace.

Workspace access is managed from the Workspaces view. You cannot assign workspace permission sets from Structural Settings view.

You can also view an .

Generates unique alphanumeric strings of the same length as the input.

For example, for the origin value ABC123, the output value is a six-character alphanumeric string such as D24N05.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator self-consistent.

By default, the generator is not consistent.

If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates a random hash string.

Characteristics

How to configure

If is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

You use the workspace management view to configure and run data generation for an individual workspace.

When you log in to Tonic Structural, it displays the workspace management view for the workspace that was selected when you logged out.

Components of the workspace management view

The workspace management view includes the following components.

Workspace information

The top left of the workspace management view provides information about the workspace, including:

• The workspace name

• When the workspace was last updated

• The user who last updated the workspace

• Whether the workspace is a child workspace

Workspace options

The top right of the workspace management view provides general options for working with the workspace, including:

• Undo and redo options for configuration changes

• The workspace share icon, to grant workspace access to other users and groups

• The workspace download menu to:

  • Download sensitivity scan and privacy reports

  • Export and import workspace configuration

• The workspace actions menu

• The Generate Data button, to start a data generation job

Workspace navigation bar

The workspace navigation bar provides access to workspace configuration options.

Displaying the workspace management view

To display the workspace management view for a workspace:

• On Workspaces view, in the Name column either:

  • Click the workspace name. The workspace management view opens to Privacy Hub.

  • Click the dropdown icon, then select a workspace management option.

• Click the search field at the top. A list of available type the name of the workspace. As you type, Tonic displays a list of matching workspaces. In the list, click the workspace name.

Collapsing and expanding the workspace heading

To reduce the amount of vertical space used by the heading of the workspace management view, you can collapse it.

To collapse the heading, click the collapse icon in the Structural heading.

When you collapse the workspace management heading:

• The workspace information is hidden. The workspace name is displayed in the search field.

• The workspace options are moved up into the Structural heading.

The workspace navigation bar remains visible.

When you collapse the heading, the collapse icon changes to an expand icon. To restore the full heading, click the expand icon.

You can export a workspace configuration to a JSON file, and import configuration from a workspace configuration JSON file.

For example, you might want to preserve a version of the workspace configuration before you test other changes. You can then use the exported file to restore the original configuration.

Or you might want to use a script to make changes to an exported configuration file. You can then import the updated file to update the workspace configuration.

Information in the exported file

The workspace JSON configuration file includes the following information:

• Sensitivity designations that you assigned to columns

• Assigned table modes

• Assigned column generators

• Subsetting configuration

• Post-job script configuration

Exporting the workspace configuration

To export the workspace configuration, either:

• On the workspace management view, from the download menu, select Export Workspace.

• On Workspaces view, click the actions menu for the workspace, then select Export.

When you export a child workspace, the exported workspace does not retain any of the inheritance information. The exported information is the same for all exported workspaces.

Importing a workspace configuration file

To import a workspace configuration file:

1. Select the import option. Either:

   • On the workspace management view, from the download menu, select Import Workspace.

   • On Workspaces view, click the actions menu for the workspace, then select Import.

2. On the Import Workspace dialog, to select the file to import, click Browse.

3. After you select the file, click Import.

When you import a workspace configuration into a child workspace, Tonic Structural only updates the configuration that can be overridden. If a configuration must be inherited from the parent workspace, then it is not affected by the imported configuration. For more information, go to About workspace inheritance.

Tonic Structural uses workspace permission sets for role-based access (RBAC) of each workspace.

A workspace permission set is a set of workspace permissions. Each permission provides access to a specific workspace feature or function.

Structural provides built-in workspace permission sets. Enterprise instances can also configure custom permission sets.

To share workspace access, you assign workspace permission sets to users and, if you use SSO to manage Structural users, to SSO groups. Before you assign a workspace permission set to an SSO group, make sure that you are aware of who is in the group. The permissions that are granted to an SSO group automatically are granted to all of the users in the group. For information on how to configure Structural to filter the allowed SSO groups, go to Synchronizing SSO groups with Structural.

You cannot remove the owner workspace permission set from the workspace owner. By default, the owner permission set is the built-in Manager permission set.

To change the current access to the workspace:

1. To manage access to a single workspace, either:

   • On the workspace management view, in the heading, click the share icon.

   • On Workspaces view, click the actions menu for the workspace, then select Share.

2. To manage access for multiple workspaces:

   1. Check the checkbox for each workspace to grant access to.

   2. From the Actions menu, select Share Workspaces.

3. The workspace access panel contains the current list of users and groups that have access to the workspace. To add a user or group to the list of users and groups, begin to type the user email address or group name. From the list of matching users or groups, select the user or group to add. Free trial users can invite other users to start their own free trial. Provide the email addresses of the users to invite. The email addresses must have the same corporate email domain as your email address. When the invited users sign up for the free trial, they are added to the Structural organization for the free trial user that invited them and have access to the workspace.

4. For a user or group, to change the assigned workspace permission sets:

   1. Click Access. The dropdown list is populated with the list of custom and built-in workspace permission sets. If you selected multiple workspaces, then on the initial display of the workspace sharing panel, for each permission set that a user or group currently has access to, the list shows the number of workspaces for which the user or group has that permission set. For example, you select three workspaces. A user currently has Editor access for one workspace and Viewer access for the other two. The Editor permission set has 1 next to it, and the Viewer permission set has 2 next to it.

   2. Under Custom Permission Sets, check the checkbox next to each workspace permission set to assign to the user or group. Uncheck the checkbox next to each workspace permission set to remove from the user or group.

   3. Under Built-In Permission Sets, check the workspace permission set to assign to the user or group. You can only assign one built-in permission set. By default, for an added user or group, the Editor permission set is selected. To select a built-in workspace permission set that is lower in access than the currently selected permission set, you must first uncheck the selected permission set. For example, if Editor is currently checked, then to change the selection to Viewer, you must first uncheck Editor.

5. To remove all access for a user or group, and remove the user or group from the list, click Access, then click Revoke.

6. To save the new access, click Save.

For self-hosted instances, Structural provides environment settings to configure features that include:

• Consistency across runs and databases

• Data generation performance

The Advanced Workspace Overrides section of the workspace details view allows you to override those environment settings for an individual workspace.

For example, the environment setting TONIC_TABLE_PARALLELISM determines the number of tables that Structural processes simultaneously. You can then override that value within individual workspaces.

The workspace overrides are available on both self-hosted instances and on Structural Cloud.

Configuring the overrides

To display the available override settings, expand Advanced Workspace Overrides.

Enabling and setting an override

For information on how to configure the statistics seed, go to .

For other settings, to enable the override and set the override value:

1. Toggle the setting to the on position.

1. Set the value.

Removing an override

To remove the override, toggle the setting to the off position.

Available overrides

Workspace statistics seed for cross-run consistency

For generators where consistency is enabled, a statistics seed enables consistency across data generation runs. The Structural-wide statistics seed value ensures consistency across both data generation runs and workspaces.

You use the Override Statistics Seed setting to override the Structural-wide statistics seed value.

You can either disable consistency across data generations, or provide a seed value for the workspace. The workspace seed value ensures consistency across data generation runs for that workspace, and across other workspaces that have the same seed value.

For details about using seed values to ensure consistency across data generation runs and databases, go to .

Data generation performance settings

Structural provides environment settings to manage data generation performance. For example, these settings include configuration for parallel processing.

From Advanced Workspace Overrides, you can override some of these data generation performance settings for an individual workspace.

Data encryption and decryption keys

To use Structural data encryption, you must provide encryption and decryption keys.

You use the Override Data Decryption Key and Override Data Encryption Key settings to override the Structural-wide keys that are provided in the environment settings.

Destination database schema creation

Some data connectors allow you to configure whether you provide the schema for the destination database. For more information, go to related information for Databricks, MySQL, Oracle, Snowflake on AWS, Snowflake on Azure, and SQL Server.

From Advanced Workspace Overrides, you can override the instance-wide configuration.

Overwrite handling for Databricks and Amazon EMR

Databricks and Amazon EMR allow you to configure how Structural handles overwrites of existing data.

You use the Override Workspace Default Error on Override and Override Workspace Default Save Mode settings to override the instance-wide configuration.

This generator replaces letters with random other letters and numbers with random other numbers. Punctuation, whitespace, and mathematical symbols are preserved.

For example, for the following input string:

ABC.123 123-456-789 Go!

The output would be something like:

PRX.804 296-915-378 Ab!

This generator securely masks letters and numbers. There is no way to recover the original data.

Character Scramble is similar to Character Substitution, with a couple of key differences.

While you can enable consistency for the entire value, Character Scramble does not always replace the same source character with the same destination character. Because there is no guarantee of unique values, you cannot use Character Scramble on unique columns.

Character Substitution, however, does always map the same source character to the same destination character. Character Substitution is always consistent, which makes it less secure than Character Scramble. You can use Character Substitution on unique columns.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator self-consistent.

By default, the generator is not consistent.

If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates a random double number between the specified minimum (inclusive) and maximum (exclusive).

Characteristics

How to configure

To configure the generator:

1. In the Minimum field, type the minimum value to use in the output values. The minimum value is inclusive. The output values can be that value or higher.

2. In the Maximum field, type the maximum value to use in the output values. The maximum value is exclusive. The output values are lower than that value.

3. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates an address-like string to replace either:

• For a Canadian postal address, the street name or postal code.

• For a United Kingdom (UK) mailing address, the postal code.

To replace a Canadian postal code:

• The generator selects a real postal code that starts with the same three digits - has the same Forward Sortation Area (FSA) - as the original postal code, but that has a different Local Delivery Unit (LDU).

• For a postal code whose FSA is not on the list that the generator uses, you can provide a fallback value to use.

To replace a UK postal code, the generator selects a real postal code.

Characteristics

How to configure

To configure the generator:

1. From the Generator Type dropdown list, select International Address.

2. From the Country dropdown list, select the country (Canada or United Kingdom).

3. From the Address Component dropdown list, select the address component that this column contains. For Canada, the available options are:

   • Street Name

   • Postal Code

   For the UK, the only option is to generate a postal code.

4. For a Canadian postal code, in the Fallback Value field, type the FSA to use if the value in the data does not exist. For example, the FSA in the data might be new and not yet in the list that Structural uses, or the FSA might be invalid. By default, the fallback value is NULL, meaning that in the destination data, the postal code value is the string literal "NULL".

5. Toggle the Consistency setting to indicate whether to make the column self-consistent. By default, consistency is disabled.

6. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generators transform the data in a source database column. You assign the generators to use. Tonic Structural offers a variety of generators to transform different types of data.

For details about how to assign and configure generators, and manage generator presets, go to Generator assignment and configuration.

You can also view this video overview of generators and how they work.

About the available generators

Generator characteristics and types

Generates a random boolean value.

Characteristics

How to configure

To configure the generator, in the Percent True field, enter the percentage of values to set to True in the output.

For example, if you set this to 60, then 60% of the output values are True, and 40% of the output values are False.

If you set this to 100, then all of the output values are True.

If you set this to 0, then all of the output values are False.

If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates unique integer values. By default, the generated values are within the range of the column’s data type.

You can also specify a range for the generated values. The source values must be within that range.

This generator cannot be used to transform negative numbers.

Characteristics

How to configure

To configure the generator:

1. In the Minimum field, enter the minimum value to use for an output value. The minimum value cannot be larger than any of the values in the source data.

2. In the Maximum field, enter the maximum value to use for an output value. The maximum value cannot be smaller than any of the values in the source data.

3. Toggle the Consistency setting to indicate whether to make the column self-consistent. By default, consistency is disabled.

4. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

This generator scrambles characters, but preserves formatting and keeps the file extension intact.

For example, for the following input value:

DataSummary1.pdf

The output value would look something like:

RsnoPwcsrtv5.pdf

This generator securely masks letters and numbers. There is no way to recover the original data.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator self-consistent.

By default, the generator is not consistent.

If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates timestamps that fit an event distribution. The source timestamp must include a date. It cannot be a time-only value.

Link columns to create a sequence of events across multiple columns. This generator can be partitioned by other columns.

Characteristics

How to configure

To configure the generator:

1. From the Link To dropdown list, select the other Event Timestamps generator columns to link this column to. Linking creates a sequence across multiple columns.

2. From the Partition drop-down list, select one or more columns to use to partition the data. The selected columns must have their generator set to either Passthrough or Categorical. For more information about partitioning and how it works, go to Partitioning a column.

3. The Options list displays the current column and linked columns. Use the Up and Down buttons to configure the column sequence.

4. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates unique numeric strings of the same length as the input value.

For example, for the input value 123456, the output value would be something like 832957.

You can apply this generator only to columns that contain numeric strings.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator self-consistent.

By default, the generator is not consistent.

If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

The Categorical generator shuffles the existing values within a field while maintaining the overall frequency of the values. It disassociates the values from other pieces of data. Note that NULL is considered a separate value.

For example, a column contains the values Small, Medium, and Large. Small appears 3 times, Medium appears 4 times, and Large appears 5 times. In the output data, each value still appears the same number of times, but the values are shuffled to different rows.

This generator is optimized for categories with fewer than 10,000 unique values. If your underlying data has more unique values (for example, your field is populated by freeform text entry), we recommend that you use the Character Scramble or Custom Categorical generator.

Characteristics

How to configure

To configure the generator:

1. From the Link To dropdown, select the columns to link to the current column. You can select from other columns that use the Categorical generator.

2. Toggle the Differential Privacy setting to indicate whether to make the output data differentially private. By default, differential privacy is disabled.

3. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

A version of the Categorical generator that selects from values that you provide instead of shuffling the original values.

Characteristics

How to configure

To configure the generator:

1. From the Link To dropdown list, select the columns to link this column to. You can only select other columns that use the Custom Categorical generator.

2. In the Custom Categories text area, enter the list of values that the generator can choose from. Put each value on a separate line. To add a NULL value to the list, use the keyword {NULL}.

3. Toggle the Consistency setting to indicate whether to make the column consistent. By default, consistency is disabled.

4. If you enable consistency, then by default the generator is self-consistent. To make the generator consistent with another column, from the Consistent to dropdown list, select the column. When a generator is self-consistent, then a given value in the source database is always mapped to the same value in the destination database. When a generator is consistent with another column, then a given source value in that column always results in the same value for the current column in the destination database. For example, a department column is consistent with a username column. For each instance of User1 in the source database, the value in the department column is the same.

5. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates a random IP address formatted string.

Characteristics

How to configure

To configure the generator:

1. In the Percent IPv4 field, type the percentage of output values that are IPv4 addresses. For example, if you set this to 60, then 60% of the generated IP addresses are IPv4 addresses, and 40% of the generated IP addresses are IPv6 addresses. If you set this to 100, then all of the generated IP addresses are IPv4 addresses. If you set this to 0, then all of the generated IP addresses are IPv6 addresses.

2. Toggle the Consistency setting to indicate whether to make the column consistent. By default, consistency is disabled.

3. If you enable consistency, then by default the generator is self-consistent. To make the generator consistent with another column, from the Consistent to dropdown list, select the column. When a generator is self-consistent, then a given value in the source database is always mapped to the same value in the destination database. When a generator is consistent with another column, then a given source value in that column always results in the same IP address value in the destination database. For example, an IP address column is consistent with a username column. For each instance of User1 in the source database, the value in the IP address column is the same.

4. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

This generator replaces all instances of the find string with the replace string.

For example, you can indicate to replace all instances of abc with 123.

Characteristics

How to configure

To configure the generator:

1. In the Find field, type the string to look for in the source column value. To use a regular expression to identify the source value, check the Use Regex checkbox. If you use a regular expression, use backslash ( \ ) as the escape character.

2. In the Replace field, type the string to replace the matching string with.

3. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates a random MAC address formatted string.

Characteristics

How to configure

To configure the generator:

1. In the Bytes Preserved field, enter the number of bytes to preserve in the generated address.

2. Toggle the Consistency setting to indicate whether to make the column self-consistent. By default, consistency is disabled.

3. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates unique object identifiers.

Can be assigned to text columns that contain MongoDB ObjectId values. The column value must be 12 bytes long.

Characteristics

How to configure

To configure the generator:

1. A MongoID object identifier consists of an epoch timestamp, a random value, and an incremented counter. To only change the random value portion of the identifier, but keep the timestamp and counter portions, toggle Preserve Timestamp and Incremental Counter to the on position.

2. Toggle the Consistency setting to indicate whether to make the generator self-consistent. By default, the generator is not consistent.

3. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates random host names, based on the English language.

Characteristics

How to configure

To configure the generator, toggle the Consistency setting to indicate whether to make the generator consistent.

By default, the generator is not consistent.

If you enable consistency, then by default the generator is self-consistent. To make the generator consistent with another column, from Consistent to, select the column.

When the generator is consistent with itself, then a given value in the source database is mapped to the same value in the destination database. For example, Host123 in the source database always produces MyHostABC in the destination database.

When the generator is consistent with another column, then a given source value in the other column results in the same host name value in the destination database. For example, a host name column is consistent with a department column. Every instance of Sales in the source data is given the same host name in the destination database.

If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Generates a random telephone number that matches the country or region of the input telephone number, but preserves the format. For example, (123) 456-7890 or 123-456-7890.

If the input is not a valid telephone number, the generator randomly replaces numeric characters. You can also replace invalid numbers with valid numbers.

By default, the numbers are United States telephone numbers.

If the input is a valid telephone number, or if you replace invalid numbers, then the generated numbers pass Google's libphonenumber verification.

Characteristics

How to configure

To configure the generator:

1. Toggle the Replace invalid numbers setting to indicate whether to replace invalid input values with a valid output value. By default, the generator does not replace invalid values. It randomly replaces numeric characters.

2. Toggle the Consistency setting to indicate whether to make the generator self-consistent. By default, consistency is disabled.

3. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

Passthrough is the default option.

It passes through the value from the source database to the destination database without masking it.

Characteristics

How to configure

Passthrough has no configuration options.

Generates a continuous distribution to fit the underlying data.

This generator can be linked to other Continuous generators to create multivariate distributions and can be partitioned by other columns.

Characteristics

How to configure

To configure the generator:

1. From the Link To drop-down list, select the other Continuous generator columns to link to. The linking creates a multivariate distribution.

2. From the Partition By drop-down list, select one or more columns to use to partition the data. The selected columns must have the generator set to either Passthrough or Categorical. For more information about partitioning and how it works, go to Partitioning a column.

3. Toggle the Differential Privacy setting to indicate whether to make the output data differentially private. By default, the generator is not differentially private.

4. If Structural data encryption is enabled, then to use it for this column, in the advanced options section, toggle Use data encryption process to the on position.

The table list at the left of Database View contains the list of tables in the source database. You can filter the table list and assign tables modes to the tables.

Information in the table list

The table list is grouped by schema. You can expand and collapse the list of tables in each schema. This does not affect the displayed columns.

For a workspace, each table corresponds to a file group.

For each table, the table list includes the following information:

• The name of the table.

• The number of columns that have an assigned generator (a generator other than Passthrough). The number does not display if none of the table columns has an assigned generator.

• The . The table list only shows the first letter of the table mode:

  • D = De-identify

  • S = Scale

  • T = Truncate

  • P = Preserve Destination

  • I = Incremental

For a child workspace, if the selected table mode overrides the parent workspace configuration, then the override icon displays.

To display for a table, click the arrow icon to the right of the table entry.

Filtering the table list

You can filter the table list and . You can also filter the tables based on .

As you filter the table list, the column list also is filtered to only include the columns for the filtered tables.

Filtering by table name

To filter the table list by name, in the filter field, begin to type text that is in the table name.

As you type, Tonic Structural filters the list to only display tables with names that contain the filter text.

Filtering by the assigned table mode

To filter the table list based on the assigned table mode:

1. Click Filters.

2. On the filter panel, check the checkbox next to each table mode to include. By default, the list includes all of the table modes. As you check and uncheck the table mode checkboxes, Structural adds and removes the associated tables from the list.

Filtering to exclude tables that have assigned generators

You can filter the table list to only display tables that have no assigned generators:

1. Click Filters.

2. On the filter panel, to only show tables that do not have assigned generators, check the No Generators Applied checkbox.

Assigning table modes to tables

The table mode determines the number of rows and columns in the destination database. For details about the available table modes and how they work, go to .

Updating a single table

To change the assigned table mode for a single table:

1. Click the table mode dropdown next to the table name.

2. From the table mode dropdown list, select the table mode.

3. For a child workspace, the table mode selection panel indicates whether the selected table mode is inherited from the parent workspace. If the child workspace currently overrides the parent workspace configuration, then to reset the table mode to the table mode that is assigned in the parent workspace, click Reset.

Updating multiple tables

To change the assigned table mode for multiple tables:

1. Check the checkbox for each table to change the table mode for. To select a continuous range of tables, click the first table in the range, then Shift-click the last table in the range. To select all of the tables in a schema, click the schema name.

2. Click Bulk Edit.

3. On the panel, click the radio button for the table mode to assign to the selected tables.

The Structural sensitivity scan identifies sensitive columns in source data. The scan ignores truncated tables.