Integration classifies CockroachDB data at the column level with 38 PII detectors, correlates it with users, roles and privilege grants, and flags over-privileged access and cross-border residency conflicts, without a single record leaving the customer’s infrastructure
Matters.AI, the Bengaluru-headquartered AI-native data security company, and Cockroach Labs, the New York-based maker of the distributed SQL database CockroachDB, today announced an integration that classifies personal and regulated data inside CockroachDB deployments at the column level and maps it to the exact database users, roles and privileges able to access it. The integration is available now to CockroachDB customers.
The launch lands as Indian enterprises prepare for the Digital Personal Data Protection (DPDP) Rules, notified in November 2025, with the substantive obligations on data fiduciaries taking effect from May 2027. Banks, payment companies and insurers already operate under Reserve Bank of India data-localisation and cybersecurity mandates. Enterprises adopt distributed SQL precisely because it replicates data across regions for resilience, and that is exactly what makes the two questions every regulator now asks, “where is personal data, and who can reach it?”, harder to answer, not easier.
The integration scans CockroachDB databases, tables and columns with 38 personally identifiable information (PII) detectors covering eight regulatory jurisdictions, plus detection for payment card numbers, protected health information (PHI) and secrets stored in free-text columns. It then correlates every classified column with CockroachDB’s users, roles and privilege grants to produce a live access map: which accounts can reach regulated data, which roles hold more privilege than they use, and where data sits in a jurisdiction it should not. Findings map directly to India’s Digital Personal Data Protection Act, PCI DSS, HIPAA, GDPR, ISO 27001 and SOC 2.
Classification and privilege analysis execute entirely inside the customer’s own infrastructure, under the customer’s IAM controls. Raw records and sampled values are never transmitted. Only findings and operational metadata reach the Matters.AI control plane. For regulated Indian entities that must keep customer data within the country, that architecture is not a preference. It is the requirement.
“Enterprises distributed their databases to survive anything. In doing so, they made their most sensitive data harder to see than ever: more regions, more tables, more roles, and still no answer to the simplest
question a CISO can ask: who can reach this data right now? With Cockroach Labs, we’re answering that at the column level, inside the customer’s own environment. That’s what an AI security engineer is for,” said Keshava Murthy, co-founder and CEO of Matters.AI.
The cost of not knowing is now on record. IBM’s 2026 Cost of a Data Breach Report puts the average breach in India at a record ₹25.5 crore, up 15.9 per cent in a year, with financial services the most expensive sector at ₹40.9 crore per breach. Indian organisations without security automation took an average of 236 days to identify a breach. Under the DPDP Act, the Data Protection Board of India can impose penalties of up to ₹250 crore per instance for failing to implement reasonable security safeguards.
“Together with Matters.AI, we’re making data protection seamless for our customers. This integration gives teams instant visibility into where their sensitive data lives, who can access it, and what's happening to it, supporting their growth every step of the way," said Tejas Baldev, Vice President of Sales, APAC, Cockroach Labs.
Cockroach Labs has operated an engineering centre in Bengaluru since 2023 and hosted its RoachFest customer conference in the city in 2025. Matters.AI raised US$6.25 million (about ₹55 crore) in seed and pre-seed funding in October 2025, co-led by Kalaari Capital and Endiya Partners, to build what it calls the first AI security engineer for enterprise data.
