Data lineage - on-premise architecture

Jul 2, 2026 · 3 min read
ressources

In the most security-sensitive environments (banking, insurance…), {openAudit} can be deployed directly at the Client’s site, on-premise or in a Cloud tenant of their choice, on a dedicated VM hosting data lineage collection, processing, and exposure.

Key point: processing, metadata, and repositories stay within the Client’s environment; no external SaaS component is required.

Diagram: on-premise architecture

Metadata collection

Containers specialized by technology connect to databases, ETL/ELT platforms, data visualization tools, and audit databases through dedicated service accounts; passwords are encrypted after first use. They produce standardized CSV files that the Client can check before processing.

Audit logs, which may contain sensitive information, can be anonymized by a dedicated container before being integrated.

Processing

The oA.Job server parses and consolidates the metadata, which is stored in the oA.mdb columnar database (MonetDB). This very rich repository can be exported (dump) in the format the Client needs for specific analyses; queries are provided to explore it.

Exposure

Data lineage is available through the Mosaïc web portal, hosted on the VM. It can also feed a third-party solution, typically a data catalog.

Overall flow mapping

Screenshot: Overall flow mapping – on-premise architecture

Automatic reconstruction of dependencies between databases, ETL/ELT processes, and usage in data visualization tools.

Typical use case: impact analysis before modifying a table or a business indicator.

Usage analysis

Screenshot: Usage analysis – on-premise architecture

Cross-referencing data lineage with audit logs separates the objects actually used from unconsumed branches, and reveals simplification opportunities.

Detailed data lineage

Screenshot: Detailed data lineage – on-premise architecture

Navigation down to field level, with direct access to the transformation code (drill through) to identify and fix an issue in a flow.

Data lineage in dashboards

Screenshot: Data lineage in dashboards – on-premise architecture

End-to-end traceability, from data feeds through business rules to the dashboard cell.

Typical use case: validating a business indicator or tracing the origin of a displayed value.

Frequently asked questions

Can {openAudit} be deployed entirely in our own environment, without SaaS?
Yes. {openAudit} can be deployed on-premise or in a cloud tenant chosen by the client, on a dedicated VM. Processing, metadata and repositories stay hosted at the client, and no external SaaS component is required.
Which components are installed for on-premise data lineage?
Containerized collectors for each technology, the oA.Job server for parsing and consolidation, the oA.mdb technical repository (MonetDB) and the Mosaïc web portal for browsing, all hosted on the dedicated VM.
How is sensitive information in audit logs protected?
Audit logs can be anonymized by a dedicated container before they are loaded. Collectors produce standardized CSV files that the client can review and validate before processing, and service account passwords are encrypted after first use.
How detailed is the data lineage?
Down to field level, with the transformations visible, and all the way to the dashboard cell. Cross-referenced with audit logs, it also identifies the objects actually used and the branches never consumed.
Équipe Ellipsys
Authors
{openAudit} | Data Lineage & Migration
Ingénieurs IT spécialisés en data lineage technique, migration BI/ETL et architectures SQL ouvertes.