Hi everyone — I wanted to share what we’ve been working on for the past few months. Monoid is a self-hosted, open-source first platform for automating data privacy requirements.
A (very simplified) primer for people who aren’t as familiar with data privacy law: one common stipulation in a number of data privacy regulations (e.g. GDPR, CPRA, etc.) is the requirement for businesses to create a map of user data across places where the data is stored & fulfill requests (Data Subject Requests, or DSR’s) for export and/or deletion of this data.
Lots of proprietary solutions exist to help businesses meet these guidelines (OneTrust, DataGrail, etc.) by integrating with the data silos that businesses use to aid them in mapping personal data and fulfilling the user privacy requests.
I think that an open-source offering contributes to this category meaningfully, though, for a few reasons:
1. It seems antithetical to not give companies the option to host software that integrates with sensitive data silos (especially with the intent of keeping it private) locally.
2. The number of potential data silos means that virtually all existing solutions have coverage gaps for any given customer. We thought that Airbyte’s approach to solving this for ETL (by offering an easy way for people to build & contribute their own connectors) could be a smart way to solve this problem, so we used that inspiration to design Monoid. At Monoid’s core are open-source privacy connectors with DB’s, warehouses, SaaS tools, and more. These connectors let organizations automate user data export/deletion (for DSARs) and scan for/map PII.
3. Open-source lowers the activation energy required for companies to comply with privacy law (two-line deploy)
4. This isn’t a virtue of the open-source approach per-se, but we designed Monoid with full automation in mind; mapping, scanning, and request fulfillment are all automated because the privacy connectors are made to read/write/forward privacy requests to the data silos. Most software solutions in this space are missing this component, or have it only nominally.