Paste a schema.prisma, a Supabase or Postgres dump, a Drizzle schema, plain CREATE TABLE SQL, or a schema.cresco. You get a map of which tables hold data about real people, and what, if anything, is standing in front of them.
↳
Your schema never leaves this page. The check runs in your browser: nothing is uploaded, nothing is stored, and there is no account. Open your network tab, or turn off your wifi, and run it anyway. Paste a client's schema without thinking twice.
No schema to hand? Try one of these.
Reads Prisma, Drizzle, Postgres, MySQL, SQLite, Supabase dumps and schema.cresco.
What this does not do
It reads column names, not your data. So notes_about_the_patient is invisible to it, and email_template_id is a false positive. The patterns are deliberately broad: a false positive costs you one line in a report, a false negative costs somebody their users' data.
It cannot see your application code. If your authorisation lives in middleware, a resolver or a route handler, this has no way to read it and does not pretend to.
It is not a penetration test and not a security audit. It answers one question from one file.
It reads shapes, not dialects. If the table and column count it reports back looks wrong, trust your eyes over the tool.
This check is one part of CrescoDB
It keeps the access rule in the same file as the table, refuses to deploy one that would expose personal data, ships to a server you own, and proves your backups restore. Free on your own machine, forever, no card.