Show HN: DataParade – generate dataflow diagrams from code for risk assessments

As a privacy and security engineer for the past nine years, I’ve probably done close to 1000 privacy and security risk assessments. The pain points and pet peeves I’ve come across in this work led me to build DataParade. Questionnaires suck, and so does cramming in a risk assessment right before you want to launch.

PARADE stands for Processing Activity Risk Assessment Diagramming Environment. The premise is simple - a dataflow diagram, embedded with security and privacy controls and metadata, can answer all the questions in a security or privacy risk assessment. Why dataflow diagrams? Because risk follows dataflow. And because a picture really is worth a thousand words, especially in this context.

Early feedback told me that nobody wants to create another artifact from scratch. So my first priority has been to build out a code-scan-to-diagram pipeline which allows you to bootstrap diagrams using our CLI tool (https://github.com/DataParade-io/dataparade-cli)

This is what the CLI tool does today: - Point the CLI at a repo, and it writes a dataflow.json you can import as a starting diagram in the DataParade app. After the scan, you will see a link to our web app where you can further manipulate the diagram, continue annotating it with security and privacy properties, and add more nodes, data transfers, and actors.

- No paywall. I'm just looking to stress-test the scanner across real codebases right now and get general feedback; maybe identify some design partners along the way.

- It currently parses TypeScript, JavaScript, Python, and Terraform (Java/Go on deck).

- The scan runs locally. By default, the resulting diagram is uploaded to a workspace so you get a link to open it in the app (use the --skip-auto-upload flag to keep it fully local).

- .env files never get read.

- We don't point an LLM at your repo and hope. A deterministic pattern engine derives your dataflow diagram directly from the code. An optional AI pass enriches it and cites evidence for every suggestion; or use the --no-ai-inference flag for deterministic-only output with zero model calls.

- The optional AI enrichment runs through our platform, so anonymous AI scans are rate-limited (to keep costs sane during this stress test). If you hit the limit, add the --no-ai-inference flag to keep going structurally, or grab a workspace key.

- Open source, GPL-3.0: https://github.com/DataParade-io/dataparade-cli

My ask: I’m looking for feedback on scans/diagrams across a wide range of architectures and technologies…

- Is your diagram missing a service?

- Did it draw a flow backwards?

- Did it choke on your monorepo?

- What other languages/frameworks would you like to see supported?

- Any other suggestions on how we can make DataParade awesome?

The more stacks we see, the more robust DataParade becomes.

I look forward to reading through your feedback in these comments (both good and bad).

Thank you in advance!