To map data flow in a low-code workflow, list the trigger and source, write down every step and sub-flow that touches the data, record each final destination, and compare the fields moved with the fields needed. Pay special attention to multi-hop paths where one flow hands data to another.
Why mapping matters
OWASP's Sensitive Data Leakage risk (CD-SEC-04) notes that citizen development tools usually cannot classify, secure or track sensitive data over an app's lifecycle. They do not know the purpose of the data they process. Connecting disparate systems also creates undocumented dependencies, so a small change in one place can cascade.
OWASP's example: a sales operations analyst syncs CRM data into a marketing database. The sync includes personal data the marketing use does not need, and the marketing system sits in a SaaS tool with weaker controls. A schema change in the CRM can then mis-map fields downstream and spread both exposure and bad data.
The map in five steps
- Name the source. Which system, which table or object, who is allowed to see it?
- List each step. Include sub-flows, which can have different or missing controls from the parent.
- Note each transformation. Where fields are dropped, joined or renamed.
- Name each destination. Databases, spreadsheets, email, chat, AI services, logs.
- Mark the boundary. Which hops leave your organization or your tenant?
A worked example
| Hop | From | To | Fields moved | Needed? | Note |
|---|---|---|---|---|---|
| 1 | CRM | Flow A | Name, email, phone, notes | Name, email | Drop phone and notes |
| 2 | Flow A | Sub-flow B | Name, email | Yes | Sub-flow lacks logging |
| 3 | Sub-flow B | Marketing tool | Name, email | Yes | Third party, check contract |
| 4 | Flow A | Team spreadsheet | Full record | No | Remove, or restrict sharing |
The review turns up two findings that a quick glance at the app would miss: extra fields at hop 1 and a full copy at hop 4.
Questions for each hop
- Is this field needed, or just convenient?
- Is the destination approved for this data class?
- Who can read the copy, and for how long is it kept?
- If the source schema changes, what breaks?
Fixes
- Send only the fields the destination needs.
- Use standardized, secure transfer between combined workflows, as OWASP recommends.
- Document inputs and outputs for every sub-flow.
- Involve security in review for apps that touch sensitive data.
- Watch logs and environment variables supplied by the platform for stray sensitive values.
Where Safeguard fits
Safeguard focuses on software supply chain and engineering risk, so it does not map platform data flows. For code your teams write around these tools, the dependency scanning and SBOM features, plus the free scan at https://gold.safeguard.sh/scan, show what packages that code pulls in.
Quick check
Do I need to map every flow?
No. Start with flows that touch customer, employee or financial data, and flows that send data outside your tenant.
What is a multi-hop path?
A route where data passes through more than one flow or system before reaching its destination, so no single flow shows the whole picture.
Sources
Last reviewed: 19 October 2026.
