Zero-Storage ArchitectureEd25519 Cryptographic ReceiptsCI/CD Native

Stop PII Leaks Before They Reach Production.

Hornfels is an enterprise-grade CI/CD database compliance CLI that detects schema drift and prevents PII leaks during migrations without ever storing your credentials or data on external servers.

The Problem with Compliance

Database migrations are the most vulnerable point for data compliance. Every time a developer adds a new column, you risk exposing Personally Identifiable Information (PII) to downstream analytics or unmasked staging environments.

Manual schema reviews slow down deployments and often miss subtle drift. Worse, traditional compliance tools require you to send your raw database connection strings and entire schemas to their third-party cloud dashboards—creating a massive new attack surface just to check a checkbox.

You need SOC2 compliance, but you shouldn't have to compromise your infrastructure's security to get it.

Meet Hornfels.

Hornfels acts as an automated tollbooth directly inside your CI/CD pipeline. It scans your schema changes locally, flags unmasked PII, and breaks the build if a violation is detected.

Because it operates entirely via your terminal and CI runner, your database credentials and raw data never leave your environment. You get the strict compliance gating you need, without the third-party dashboard risk.

Zero-Storage Architecture
Keep your infrastructure secure. We never store your database URLs, raw schemas, or row data.
Terminal-First DX
Manage policies, waivers, and audits entirely from the CLI without logging into a web portal.
Policy as Code
Define your PII masking rules in a version-controlled .hornfels.yaml file alongside your codebase.
Offline Verification & PDF Generation
Generate cryptographically signed SOC2 compliance receipts locally. Verify any audit receipt offline using embedded QR codes and public keys. No cloud dependencies required.
"Hornfels finally let us automate our SOC2 database compliance without fighting our InfoSec team about third-party data sharing."
— Platform Engineering Lead
100% Local ScanningZero External Dashboard RiskSOC2 Ready

Ready to secure your schema migrations?

How It Works

1

Initialize in CI

Run `hornfels init` to securely provision scoped machine tokens for your pipeline.

2

Scan Locally

During a pull request, `hornfels check` analyzes your schema drift against your `.hornfels.yaml` policies.

3

Block or Pass

If unmasked PII is detected, the build fails. If clean, the migration proceeds.

4

Generate Receipt

A cryptographically signed PDF receipt is generated locally for your SOC2 auditors.

Hornfels vs Traditional SaaS Scanners

FeatureHornfelsTraditional Scanners
Data StorageZero (Local Only)Stores schemas in cloud
Interface100% CLIWeb Dashboards
SOC2 ReceiptsOffline Verifiable PDFRequires platform login
Setup SpeedUnder 5 minutesDays of InfoSec reviews
Visual AnalyticsBasic CLI status onlyRich graphical charts

* Traditional scanners win on rich graphical charts, but Hornfels wins on security and speed.

Frequently Asked Questions

Protect your pipeline from PII leaks today.

Built for zero-trust environments. Powered by Go, pgx, and Ed25519 cryptography.