SensitiveFlow.Core 1.0.0-preview.3

SensitiveFlow

<p align="center"> <img src="https://raw.githubusercontent.com/MateusjsSilva/SensitiveFlow/main/assets/logo.png" alt="SensitiveFlow logo" width="200" /> </p>

SensitiveFlow is a .NET library that brings observability and control to sensitive data flows through automatic auditing, log redaction, JSON masking, and pseudonymization. Mark your data once, get automatic protection everywhere.

Important: SensitiveFlow is a tool to help you manage sensitive data safely, not a guarantee of complete data protection by itself. You are responsible for how you use these primitives in your application and for ensuring they meet your requirements.

Why SensitiveFlow?

Sensitive data flows through your application constantly: EF Core database saves, HTTP JSON responses, structured logs, error messages. Without SensitiveFlow, that data is exposed everywhere—in logs, in responses, in backups, in error traces—often with no visibility into where it leaked or why.

SensitiveFlow gives you:

• Automatic audit trail — Every database change to a sensitive field is logged with who changed it, when, what changed, and why (from your request context). No manual instrumentation.
• Log redaction — Your structured logger scrubs sensitive values before they reach any sink. A developer who accidentally logs a customer's email will never see it in the logs; it's redacted automatically.
• JSON response masking — ASP.NET Core responses automatically mask sensitive fields in your JSON output without changing your serialization code.
• Reversible pseudonymization — Replace real values with tokens while keeping them queryable. Trade a customer's email for token_abc123 in logs and analytics, then recover the original when needed.
• Data retention & erasure — Declare retention policies on fields; SensitiveFlow will anonymize or delete expired records on schedule.
• Data subject export — Generate privacy reports showing all data associated with a customer in your system.
• Health checks — Monitor whether your audit infrastructure is working; if your audit database fails, you'll know immediately instead of silently losing records.

Packages

Quick Start

1. Install and annotate

dotnet add package SensitiveFlow.AspNetCore.EFCore
dotnet add package Microsoft.EntityFrameworkCore.SqlServer # or your EF Core provider

Then mark your sensitive fields:

using SensitiveFlow.Core.Attributes;
using SensitiveFlow.Core.Enums;

public class Customer
{
    public Guid Id { get; set; }
    public string UserId { get; set; } = string.Empty;

    [PersonalData(Category = DataCategory.Identification)]
    public string Name { get; set; } = string.Empty;

    [PersonalData(Category = DataCategory.Contact)]
    public string Email { get; set; } = string.Empty;

    [SensitiveData(Category = SensitiveDataCategory.Financial)]
    [RetentionData(Years = 5, Policy = RetentionPolicy.AnonymizeOnExpiration)]
    public string TaxId { get; set; } = string.Empty;
}

2. Register and start

using SensitiveFlow.AspNetCore.EFCore.Extensions;

// Register SensitiveFlow
builder.Services.AddSensitiveFlowWeb(options =>
{
    options.UseProfile(SensitiveFlowProfile.Balanced);
    options.UseEfCoreStores(
        audit => audit.UseSqlServer("Server=.;Database=Audit;..."),
        tokens => tokens.UseSqlServer("Server=.;Database=Tokens;..."));
    
    options.EnableEfCoreAudit();
    options.EnableAspNetCoreContext();
    options.EnableJsonRedaction();
    options.EnableLoggingRedaction();
    options.EnableValidation();
    options.EnableHealthChecks();
});

// Wire the interceptor and middleware
builder.Services.AddDbContext<AppDbContext>((sp, opt) =>
    opt.UseSqlServer(connectionString)
        .AddInterceptors(sp.GetRequiredService<SensitiveDataAuditInterceptor>()));

var app = builder.Build();
app.UseSensitiveFlow();
app.MapHealthChecks("/health");

3. See the magic

Every time your code saves a customer, SensitiveFlow automatically:

• Creates an audit record showing who changed what field, when, and from what to what
• Scrubs logs — if a developer logs email: {customer.Email}, the actual email never appears in logs
• Masks JSON responses — API endpoints return "email": "[REDACTED]" instead of the real address
• Tracks IP addresses without storing them raw — instead stores a pseudonymized token
• Validates retention policies — knows when data should expire or be anonymized

No additional code needed. SensitiveFlow works at the infrastructure level.

4. Verify it works

Check the /health endpoint to ensure your audit and token infrastructure are connected:

curl http://localhost:5000/health

Success means your audit database is reachable and healthy.

Schema setup

SensitiveFlow does not create tables automatically. Before your first write, create:

• Your application tables (via EF Core migrations)
• SensitiveFlow audit/token tables (via SQL scripts or EF Core)

See Database Providers for per-provider setup and schema details. The samples create schema automatically on startup for convenience; production apps should use migrations or deployment scripts.

What You Get

Going Deeper

Once the basics work, explore:

• Durable Outbox — guaranteed audit delivery even if database is temporarily unavailable
• Retry & Backoff — automatic exponential backoff with jitter for transient failures
• Profiles — switch from Balanced to Strict (redact everything) or Permissive (trust some fields)
• Custom policies — define your own classification rules
• OpenTelemetry — emit audit events as spans and metrics for observability
• Caching token store — speed up pseudonymization lookups with in-memory cache
• Data subject reports — customize what fields appear in privacy reports

See the full documentation for all features.

Samples

The repository includes runnable examples. After cloning:

cd samples/QuickStart.Sample
dotnet run

cd ../WebApi.Sample
dotnet run

Each sample demonstrates different configurations: QuickStart keeps it minimal, WebApi shows outbox and diagnostics, MinimalApi shows routing integration, Console shows standalone usage, Redis shows distributed token store.

Advanced: Package-by-package setup

The composition layer (SensitiveFlow.AspNetCore.EFCore) is recommended. For teams needing fine-grained control over which packages to install:

See Package Reference for the full setup matrix and manual registration calls for each service.

Do not use in-memory stores in production. Audit records and token mappings must survive process restarts.

Documentation

• Documentation index
• Getting Started
• Package reference
• AI skill guide

Design Principles

• Observable behavior over aspirational goals -- instruments what actually happens with sensitive data, not what should happen in theory.
• Explicit metadata over implicit heuristics -- every classification is opt-in via attributes.
• Composition over lock-in -- each module is optional and independently testable.
• Safe defaults -- the IP address is never stored raw; the log redactor strips sensitive values before they reach any sink.
• Bring your own persistence -- IAuditStore and ITokenStore are contracts, not implementations. You choose the database.

License

MIT