Power enterprise data withgoverned virtual access
The infrastructure layer that turns distributed private data into governed views for apps, analysts and AI agents.It's also open to private deployment.
// trusted access layer
Built for teams that cannot send raw enterprise data to every tool.
Private deployment
VPC / on-prem
Governance
RBAC + masking
Auditability
Every read logged
Agent surface
MCP + typed tools
Start virtualizing today
The infrastructure layer that helps enterprise teams find, model, govern and publish data products.
Connect
postgres.core
Model
customer_360
Govern
pii.masked
Publish
sql + rest + ai
Lineage preserved from source to endpoint
Every published product keeps source, owner, policy and consumer context.
customer_id
uuid
varchar
lifetime_value
decimal
last_order_at
timestamp
// plug into your stack
Native bridges to AI agents and automation
// already integrated with
OpenAIAnthropicLangChainMCPn8nZapierCursorDrop SOFI into any AI stack
MCP-native - every governed view is also a typed tool. RBAC, masking and audit run on every agent call. No glue code, no leaking PII to LLMs.
// agent portal
Connect the client once
Four guarantees, enforced before the agent sees a row
Same plane as REST and SQL — agents inherit the same policies, with no extra wiring.
- 1
Identity
JWT or API key resolves the agent role
- 2
RBAC
Policy match for purpose + scope + plan
- 3
Mask
PII redacted column-by-column before return
- 4
Audit
Agent ID, prompt fingerprint, row count logged
Built for the workloads that won't tolerate slow
Predicate pushdown across 9 engines. DuckDB stitches the rest. Cache, policy and audit run in the same query path - not a sidecar.
p95 federated query
with native pushdown
leaving the source
audit + lineage coverage
Same governed view, three execution paths
SELECT … FROM customer_360 WHERE region = 'EU' across Postgres + Mongo + Parquet, with RBAC and masking enabled.
Reference workload: Postgres 16 (4 vCPU), Mongo 7 (Atlas M30), Parquet on S3. Numbers vary with selectivity, source latency and cache policy.
Four engineering choices behind the numbers
Predicate pushdown
Filters, joins, aggregates and CTEs rewritten by SQLGlot to the source's native dialect.
Parallel federation
DuckDB stitches multi-source results in-memory. No intermediate landing zone.
Hot-path cache
Per-view cache keyed by policy decision — never serves a stale row to the wrong role.
Same path as governance
RBAC, masking and audit are in the query plan — not a wrapper that can be bypassed.
We handle the hard governance
Masking, access control, lineage, auditability, caching and publication patterns in one layer.
// Sources to assets
Federate without copying
Files, operational databases, APIs, lakehouses and analytical stores become first-class governed assets — discovered, owned, lineaged.
// Policy in the plan
Mask before the row leaves
RBAC, column masking and purpose-of-use are enforced inside the query plan — not a wrapper. No way to bypass.
// Live or cached
Policy-aware cache
Cache is keyed by the policy decision. A masked role never sees a cached unmasked row, ever.
// LGPD by default
Consent-aware access
Per-subject opt-outs, retention windows and purpose checks resolved at query time — no quarterly spreadsheet reconciliation.
agent=ai_support view=customer_360 role=tier1 rows=14 mask=email,cpf purpose=ticket decision=allow ts=2026-05-06T11:42:18Z
// Every read
Audit you can SQL
Every access — human, app or agent — produces a structured event with prompt fingerprint, role, scope and row count. Queryable like any other view.
SQL
REST
AI
Audit
Mask
Lineage
Preview
Revoke
// One surface
Publish, preview, revoke
Roll a governed view forward, snapshot a version, deprecate a column or revoke an agent — without re-deploying consumers.
Transform data into governed products
See how SOFI turns private enterprise data into controlled, reusable access patterns.
// choose workflow
Customer 360 built without a warehouse copy
Join CRM, billing and product events into one governed product for support and revenue teams.
Salesforce
join: customer_id
Stripe
join: customer_id
Kafka
join: customer_id
customer_360
One reusable surface for support, revenue and AI agents — RBAC + masking applied at query time.
// schema · customer_360
customer_id
uuid
varchar
lifetime_value
decimal
last_order_at
timestamp
tier
enum
cpf
varchar
No warehouse copy
Pushdown across 3 live sources.
People love building governed views with SOFI
Engineers, governance leads and platform owners - what they say after their first SOFI deployment.
“We replaced three ETL pipelines with a single SOFI virtual view. Same governance, no nightly batch, queries run live against the source.”
Lead Data Engineer
Tier-1 retail bank
“The MCP surface is what sold us. Our agents query governed views directly — RBAC and masking apply automatically, no glue code.”
Head of AI Platform
Healthcare provider
“First governed customer-360 view shipped in 9 days. Three years of failed MDM, undone by predicate pushdown and a query plan you can actually read.”
Principal Architect
Insurance group
“LGPD audit went from a quarterly fire-drill to a SQL query. Lineage and access logs are first-class — not a spreadsheet anymore.”
Data Governance Officer
Public sector agency
“We deploy SOFI inside our VPC, behind the same firewall as the databases. Not one byte of customer data leaves the boundary.”
VP Infrastructure
Logistics platform
“Pushdown across Postgres, Oracle and Snowflake works the way the docs say it does. That alone is rare in this category.”
Staff Data Engineer
B2B SaaS, 500+ employees
Less licensing weight, faster to production
Where legacy data virtualization vendors charge per CPU and DIY ETL projects burn engineering quarters, SOFI ships governed views in weeks.
8×
less time to first governed view
vs DIY ETL
60%
lower TCO over 24 months
vs per-CPU legacy DV
0
data pipelines to maintain
for app-side filtering
// why on-premise
“Customers want one governed layer across their stack — without lifting a single byte out of their environment. That's the deployment model SOFI was designed for.”
Enterprise positioning · 2026
0%
Data residency in private cloud
0+
Database engines federated
<0 wk
Time to first governed view
0%
Audit coverage on access
// need a benchmark vs Denodo, Dremio or Starburst?
Request a benchmark// get started
Ready to virtualize?
Spin up a governed view across your private data in under two weeks. No data leaves your environment — and every read is logged from day one.
No credit card needed · Private deployment available
Frequently asked questions
Everything prospects need to understand the SOFI deployment model.
// 11 questions · 3 categories
Is SOFI still available as SaaS?
Only as a demo and starter environment. The strategic offer is the self-hosted PaaS / on-premise deployment.
What channels can consume SOFI views?
SQL users, REST/OData clients, internal applications, BI tools and AI agents can reuse the same governed views.
How long does a typical on-premise rollout take?
Most customers go from connector validation to first governed view in under two weeks of guided onboarding.
Which databases are supported out of the box?
PostgreSQL, Oracle, SQL Server, MySQL, MongoDB, ClickHouse, Cassandra, Neo4j, Elasticsearch, plus CSV, JSON, Parquet and Excel.