SAP Data Custodian

Organizations are accelerating cloud-first adoption to gain scalability, flexibility, predictable costs, and lower capital expenditures, a trend amplified by COVID-driven remote work. As data becomes the most valuable business asset, enterprises increasingly rely on public clouds to collect, store, and process information at required scale. Yet modern architectures and cloud deployment patterns introduce new security risks; rising breach numbers show even large, well-funded teams struggle to keep pace, often discovering cloud data vulnerabilities only after suffering financial, legal, and reputational damage.

A central challenge is the scale and complexity of governing sensitive data across heterogeneous multi-cloud and hybrid environments. Data is dispersed across incompatible systems and security controls, constantly moving and transforming through multiple services. Effective governance becomes impractical without continuous visibility into where data resides, how it is classified, and who accesses it. Compliance is also a moving target: post-GDPR regulations proliferate globally, and decisions like Schrems II can abruptly change technical requirements, forcing rapid adoption of new controls.

SAP Data Custodian is positioned as a data-centric alternative to component-by-component security, delivered as a fully managed, natively multi-cloud SaaS solution. It provides a centralized control plane for data transparency, governance, protection, and compliance across SAP applications, SAP-managed clouds, and major hyperscalers. The platform includes two integrated services: Transparency and Control Service (TCS) for monitoring data posture, detecting drift, alerting on violations, and preventing non-compliant flows; and Key Management Service (KMS) for unified encryption key lifecycle management. TCS uses connectors, log/API analysis, policy templates (e.g., GDPR, PCI DSS), incident workflows, and ML-based anomaly detection. KMS is FIPS 140-2 Level 2/3 certified and supports key grouping. Strengths include breadth, reporting, and multi-cloud support, while current limitations include partial SAP application coverage and limited, non-extensible classification patterns.

• COVID-era work-from-home conditions increased worldwide cloud adoption.
• Data is distributed across multi-cloud and hybrid environments in many systems, models, and formats with incompatible security controls.
• After GDPR, numerous countries and state-level governments introduced strict rules for handling personally identifiable information with large fines for violations.
• Schrems II can change technical requirements for storing cloud data quickly and introduce mandatory security controls.
• SAP Data Custodian is a fully managed SaaS offering deployed by customers on AWS, GCP, or Azure in a chosen geographic region.
• The platform consists of two separately deployed services unified in one UI: Transparency and Control Service and Key Management Service.
• TCS supports connectors for AWS, Microsoft Azure, and Google Cloud Platform and integrates with SAP applications.
• The solution distinguishes Alerts (rule-based policy violations) from Anomalies (ML-identified behavior deviations).
• Information Detectors support only built-in sensitive-data types and do not allow customers to define custom patterns.
• The Key Management Service is certified to FIPS 140-2 Level 2 and FIPS 140-2 Level 3 standards.

• “Data is quickly becoming the most valuable asset for every organization, more important than oil or land.”
• “Data never exists in a vacuum, isolated within just a single database, application, or network.”
• “It is constantly moving and transforming, passing through multiple systems, and being processed by numerous applications and services.”
• “Even the basic data governance at this scale becomes impossible without full visibility into data locations, classification, access policies, and so on.”
• “Traditionally, data protection solutions have focused on securing individual infrastructure components… but this approach is no longer sustainable in multi-cloud environments.”
• “Another approach - data-centric security - is gaining popularity, focusing instead on data itself, providing full visibility into data at every stage of its active life cycle.”
• “The primary focus of Data Custodian is to provide transparency for companies with regards to where their data is stored across multi-cloud environments.”
• “As opposed to traditional tools focusing on infrastructure security, Data Custodian monitors and analyzes the behavior of data itself.”
• “Unions - sets of related policies grouped around a common data regulation or business objective.”
• “Since this process is continuously repeated, each change in data posture can be immediately identified.”