Stop PII Leaks Before
They Reach Production.
Hornfels is an enterprise-grade CI/CD database compliance CLI that detects schema drift and prevents PII leaks during migrations without ever storing your credentials or data on external servers.
The Problem with Compliance
Database migrations are the most vulnerable point for data compliance. Every time a developer adds a new column, you risk exposing Personally Identifiable Information (PII) to downstream analytics or unmasked staging environments.
Manual schema reviews slow down deployments and often miss subtle drift. Worse, traditional compliance tools require you to send your raw database connection strings and entire schemas to their third-party cloud dashboards—creating a massive new attack surface just to check a checkbox.
You need SOC2 compliance, but you shouldn't have to compromise your infrastructure's security to get it.
Meet Hornfels.
Hornfels acts as an automated tollbooth directly inside your CI/CD pipeline. It scans your schema changes locally, flags unmasked PII, and breaks the build if a violation is detected.
Because it operates entirely via your terminal and CI runner, your database credentials and raw data never leave your environment. You get the strict compliance gating you need, without the third-party dashboard risk.
"Hornfels finally let us automate our SOC2 database compliance without fighting our InfoSec team about third-party data sharing."
Ready to secure your schema migrations?
How It Works
Initialize in CI
Run `hornfels init` to securely provision scoped machine tokens for your pipeline.
Scan Locally
During a pull request, `hornfels check` analyzes your schema drift against your `.hornfels.yaml` policies.
Block or Pass
If unmasked PII is detected, the build fails. If clean, the migration proceeds.
Generate Receipt
A cryptographically signed PDF receipt is generated locally for your SOC2 auditors.
Hornfels vs Traditional SaaS Scanners
| Feature | Hornfels | Traditional Scanners |
|---|---|---|
| Data Storage | Zero (Local Only) | Stores schemas in cloud |
| Interface | 100% CLI | Web Dashboards |
| SOC2 Receipts | Offline Verifiable PDF | Requires platform login |
| Setup Speed | Under 5 minutes | Days of InfoSec reviews |
| Visual Analytics | Basic CLI status only | Rich graphical charts |
* Traditional scanners win on rich graphical charts, but Hornfels wins on security and speed.
Frequently Asked Questions
Protect your pipeline from PII leaks today.
Built for zero-trust environments. Powered by Go, pgx, and Ed25519 cryptography.