Add data inventory

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-05-30 15:07:57 -07:00
parent fa1cd6fb51
commit ca62749ba8
30 changed files with 8275 additions and 79 deletions
--- a/pkg/coredata/data.go
+++ b/pkg/coredata/data.go
@@ -0,0 +1,435 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type Data struct {
+	ID              gid.GID         `db:"id"`
+	Name            string          `db:"name"`
+	OrganizationID  gid.GID         `db:"organization_id"`
+	OwnerID         gid.GID         `db:"owner_id"`
+	DataSensitivity DataSensitivity `db:"data_sensitivity"`
+	CreatedAt       time.Time       `db:"created_at"`
+	UpdatedAt       time.Time       `db:"updated_at"`
+}
+
+func (d *Data) CursorKey(field DatumOrderField) page.CursorKey {
+	switch field {
+	case DatumOrderFieldCreatedAt:
+		return page.NewCursorKey(d.ID, d.CreatedAt)
+	case DatumOrderFieldName:
+		return page.NewCursorKey(d.ID, d.Name)
+	case DatumOrderFieldDataSensitivity:
+		return page.NewCursorKey(d.ID, d.DataSensitivity)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", field))
+}
+
+type DataList []*Data
+
+func (d *Data) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	dataID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	owner_id,
+	organization_id,
+	data_sensitivity,
+	created_at,
+	updated_at
+FROM
+	data
+WHERE
+	%s
+	AND id = @data_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"data_id": dataID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query data: %w", err)
+	}
+
+	data, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Data])
+	if err != nil {
+		return fmt.Errorf("cannot collect data: %w", err)
+	}
+
+	*d = data
+
+	return nil
+}
+
+func (d *Data) LoadByOwnerID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	owner_id,
+	organization_id,
+	data_sensitivity,
+	created_at,
+	updated_at
+FROM
+	data
+WHERE
+	%s
+	AND owner_id = @owner_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"owner_id": d.OwnerID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query data: %w", err)
+	}
+
+	data, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Data])
+	if err != nil {
+		return fmt.Errorf("cannot collect data: %w", err)
+	}
+
+	*d = data
+
+	return nil
+}
+
+func (dl *DataList) LoadByOwnerID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	ownerID gid.GID,
+	cursor *page.Cursor[DatumOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	owner_id,
+	data_sensitivity,
+	created_at,
+	updated_at
+FROM
+	data
+WHERE
+	%s
+	AND owner_id = @owner_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"owner_id": ownerID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query data: %w", err)
+	}
+
+	data, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Data])
+	if err != nil {
+		return fmt.Errorf("cannot collect data: %w", err)
+	}
+
+	*dl = data
+
+	return nil
+}
+
+func (dl *DataList) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[DatumOrderField],
+) error {
+	q := `
+SELECT
+	id,
+	name,
+	organization_id,
+	owner_id,
+	data_sensitivity,
+	created_at,
+	updated_at
+FROM
+	data
+WHERE
+	%s
+	AND organization_id = @organization_id
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query data: %w", err)
+	}
+
+	data, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Data])
+	if err != nil {
+		return fmt.Errorf("cannot collect data: %w", err)
+	}
+
+	*dl = data
+
+	return nil
+}
+
+func (d *Data) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO data (
+	id,
+	tenant_id,
+	name,
+	owner_id,
+	organization_id,
+	data_sensitivity,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@name,
+	@owner_id,
+	@organization_id,
+	@data_sensitivity,
+	@created_at,
+	@updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":               d.ID,
+		"tenant_id":        scope.GetTenantID(),
+		"name":             d.Name,
+		"owner_id":         d.OwnerID,
+		"organization_id":  d.OrganizationID,
+		"data_sensitivity": d.DataSensitivity,
+		"created_at":       d.CreatedAt,
+		"updated_at":       d.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert data: %w", err)
+	}
+
+	return nil
+}
+
+func (d *Data) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE data
+SET
+	name = @name,
+	owner_id = @owner_id,
+	data_sensitivity = @data_sensitivity,
+	updated_at = @updated_at
+WHERE
+	%s
+	AND id = @id
+RETURNING
+	id,
+	name,
+	owner_id,
+	organization_id,
+	data_sensitivity,
+	created_at,
+	updated_at
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":               d.ID,
+		"name":             d.Name,
+		"owner_id":         d.OwnerID,
+		"data_sensitivity": d.DataSensitivity,
+		"updated_at":       time.Now(),
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update data: %w", err)
+	}
+
+	data, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Data])
+	if err != nil {
+		return fmt.Errorf("cannot collect updated data: %w", err)
+	}
+
+	*d = data
+
+	return nil
+}
+
+func (d *Data) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM data
+WHERE
+	%s
+	AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": d.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete data: %w", err)
+	}
+
+	return nil
+}
+
+type DataVendor struct {
+	DataID    gid.GID   `db:"data_id"`
+	VendorID  gid.GID   `db:"vendor_id"`
+	CreatedAt time.Time `db:"created_at"`
+}
+
+func (d *Data) CreateWithVendors(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorIDs []gid.GID,
+	now time.Time,
+) error {
+	if err := d.Insert(ctx, conn, scope); err != nil {
+		return fmt.Errorf("cannot insert data: %w", err)
+	}
+
+	if len(vendorIDs) > 0 {
+		for _, vendorID := range vendorIDs {
+			_, err := conn.Exec(ctx, `
+				INSERT INTO data_vendors (tenant_id, datum_id, vendor_id, created_at)
+				VALUES ($1, $2, $3, $4)
+			`, scope.GetTenantID(), d.ID, vendorID, now)
+			if err != nil {
+				return fmt.Errorf("cannot insert data vendor: %w", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (d *Data) UpdateWithVendors(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	vendorIDs []gid.GID,
+	now time.Time,
+) error {
+	existing := &Data{}
+	if err := existing.LoadByID(ctx, conn, scope, d.ID); err != nil {
+		return fmt.Errorf("cannot load data: %w", err)
+	}
+
+	d.CreatedAt = existing.CreatedAt
+	d.UpdatedAt = now
+
+	if err := d.Update(ctx, conn, scope); err != nil {
+		return fmt.Errorf("cannot update data: %w", err)
+	}
+
+	_, err := conn.Exec(ctx, `
+		DELETE FROM data_vendors
+		WHERE tenant_id = $1 AND datum_id = $2
+	`, scope.GetTenantID(), d.ID)
+	if err != nil {
+		return fmt.Errorf("cannot delete data vendors: %w", err)
+	}
+
+	if len(vendorIDs) > 0 {
+		for _, vendorID := range vendorIDs {
+			_, err := conn.Exec(ctx, `
+				INSERT INTO data_vendors (tenant_id, datum_id, vendor_id, created_at)
+				VALUES ($1, $2, $3, $4)
+			`, scope.GetTenantID(), d.ID, vendorID, now)
+			if err != nil {
+				return fmt.Errorf("cannot insert data vendor: %w", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// UpdateWithVendorsTx updates a data entry and its vendor relationships in a single transaction
+func (d *Data) UpdateWithVendorsTx(
+	ctx context.Context,
+	db *pg.Client,
+	scope Scoper,
+	vendorIDs []gid.GID,
+	now time.Time,
+) error {
+	return db.WithTx(ctx, func(conn pg.Conn) error {
+		return d.UpdateWithVendors(ctx, conn, scope, vendorIDs, now)
+	})
+}
--- a/pkg/coredata/datum_order_field.go
+++ b/pkg/coredata/datum_order_field.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type DatumOrderField string
+
+const (
+	DatumOrderFieldCreatedAt       DatumOrderField = "CREATED_AT"
+	DatumOrderFieldName            DatumOrderField = "NAME"
+	DatumOrderFieldDataSensitivity DatumOrderField = "DATA_SENSITIVITY"
+)
+
+func (p DatumOrderField) Column() string {
+	return string(p)
+}
+
+func (p DatumOrderField) String() string {
+	return string(p)
+}
+
+func (p DatumOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *DatumOrderField) UnmarshalText(text []byte) error {
+	val := string(text)
+	switch val {
+	case string(DatumOrderFieldCreatedAt),
+		string(DatumOrderFieldName),
+		string(DatumOrderFieldDataSensitivity):
+		*p = DatumOrderField(val)
+		return nil
+	}
+	return fmt.Errorf("invalid DatumOrderField value: %q", val)
+}
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -34,4 +34,5 @@ const (
 	DocumentVersionEntityType
 	DocumentVersionSignatureEntityType
 	AssetEntityType
+	DatumEntityType
 )
--- a/pkg/coredata/migrations/20250602T225034Z.sql
+++ b/pkg/coredata/migrations/20250602T225034Z.sql
@@ -0,0 +1,20 @@
+-- Create data table
+CREATE TABLE data (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    data_sensitivity data_sensitivity NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE RESTRICT,
+    owner_id TEXT NOT NULL REFERENCES peoples(id) ON DELETE RESTRICT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+-- Create junction table for many-to-many relationship with vendors
+CREATE TABLE data_vendors (
+    datum_id TEXT NOT NULL REFERENCES data(id) ON DELETE CASCADE,
+    vendor_id TEXT NOT NULL REFERENCES vendors(id) ON DELETE CASCADE,
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (datum_id, vendor_id)
+);
--- a/pkg/coredata/organization_order_field.go
+++ b/pkg/coredata/organization_order_field.go
@@ -19,7 +19,9 @@ type (
 )

 const (
+	OrganizationOrderFieldName      OrganizationOrderField = "NAME"
 	OrganizationOrderFieldCreatedAt OrganizationOrderField = "CREATED_AT"
+	OrganizationOrderFieldUpdatedAt OrganizationOrderField = "UPDATED_AT"
 )

 func (p OrganizationOrderField) Column() string {
--- a/pkg/coredata/vendor.go
+++ b/pkg/coredata/vendor.go
@@ -461,7 +461,7 @@ WHERE %s
 `
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())

-	args := pgx.NamedArgs{"asset_id": assetID}
+	args := pgx.StrictNamedArgs{"asset_id": assetID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())

@@ -479,3 +479,93 @@ WHERE %s

 	return nil
 }
+
+func (vs *Vendors) LoadByDatumID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	datumID gid.GID,
+	cursor *page.Cursor[VendorOrderField],
+) error {
+	q := `
+WITH vend AS (
+	SELECT
+		v.id,
+		v.tenant_id,
+		v.organization_id,
+		v.name,
+		v.description,
+		v.category,
+		v.headquarter_address,
+		v.legal_name,
+		v.website_url,
+		v.privacy_policy_url,
+		v.service_level_agreement_url,
+		v.data_processing_agreement_url,
+		v.business_associate_agreement_url,
+		v.subprocessors_list_url,
+		v.certifications,
+		v.business_owner_id,
+		v.security_owner_id,
+		v.status_page_url,
+		v.terms_of_service_url,
+		v.security_page_url,
+		v.trust_page_url,
+		v.created_at,
+		v.updated_at
+	FROM
+		vendors v
+	INNER JOIN
+		data_vendors dv ON v.id = dv.vendor_id
+	WHERE
+		dv.datum_id = @datum_id
+)
+SELECT
+	id,
+	tenant_id,
+	organization_id,
+	name,
+	description,
+	category,
+	headquarter_address,
+	legal_name,
+	website_url,
+	privacy_policy_url,
+	service_level_agreement_url,
+	data_processing_agreement_url,
+	business_associate_agreement_url,
+	subprocessors_list_url,
+	certifications,
+	business_owner_id,
+	security_owner_id,
+	status_page_url,
+	terms_of_service_url,
+	security_page_url,
+	trust_page_url,
+	created_at,
+	updated_at
+FROM
+	vend
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"datum_id": datumID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query vendors: %w", err)
+	}
+
+	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	if err != nil {
+		return fmt.Errorf("cannot collect vendors: %w", err)
+	}
+
+	*vs = vendors
+
+	return nil
+}
--- a/pkg/probo/datum_service.go
+++ b/pkg/probo/datum_service.go
@@ -0,0 +1,247 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/kit/pg"
+)
+
+type DatumService struct {
+	svc *TenantService
+}
+
+type CreateDatumRequest struct {
+	OrganizationID  gid.GID
+	Name            string
+	DataSensitivity coredata.DataSensitivity
+	OwnerID         gid.GID
+	VendorIDs       []gid.GID
+}
+
+type UpdateDatumRequest struct {
+	ID              gid.GID
+	Name            *string
+	DataSensitivity *coredata.DataSensitivity
+	OwnerID         *gid.GID
+	VendorIDs       []gid.GID
+}
+
+func (s DatumService) Get(
+	ctx context.Context,
+	datumID gid.GID,
+) (*coredata.Data, error) {
+	datum := &coredata.Data{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return datum.LoadByID(ctx, conn, s.svc.scope, datumID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return datum, nil
+}
+
+func (s DatumService) GetByOwnerID(
+	ctx context.Context,
+	ownerID gid.GID,
+) (*coredata.Data, error) {
+	datum := &coredata.Data{OwnerID: ownerID}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return datum.LoadByOwnerID(ctx, conn, s.svc.scope)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return datum, nil
+}
+
+func (s DatumService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.DatumOrderField],
+) (*page.Page[*coredata.Data, coredata.DatumOrderField], error) {
+	var data coredata.DataList
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return data.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				cursor,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(data, cursor), nil
+}
+
+func (s DatumService) Update(
+	ctx context.Context,
+	req UpdateDatumRequest,
+) (*coredata.Data, error) {
+	now := time.Now()
+
+	existing := &coredata.Data{}
+	if err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return existing.LoadByID(ctx, conn, s.svc.scope, req.ID)
+	}); err != nil {
+		return nil, fmt.Errorf("cannot load data: %w", err)
+	}
+
+	datum := &coredata.Data{
+		ID:              req.ID,
+		OrganizationID:  existing.OrganizationID,
+		Name:            existing.Name,
+		DataSensitivity: existing.DataSensitivity,
+		OwnerID:         existing.OwnerID,
+		CreatedAt:       existing.CreatedAt,
+		UpdatedAt:       now,
+	}
+
+	// Update fields from request
+	if req.Name != nil {
+		datum.Name = *req.Name
+	}
+	if req.DataSensitivity != nil {
+		datum.DataSensitivity = *req.DataSensitivity
+	}
+	if req.OwnerID != nil {
+		datum.OwnerID = *req.OwnerID
+	}
+
+	if err := datum.UpdateWithVendorsTx(ctx, s.svc.pg, s.svc.scope, req.VendorIDs, now); err != nil {
+		return nil, err
+	}
+
+	return datum, nil
+}
+
+func (s DatumService) Create(
+	ctx context.Context,
+	req CreateDatumRequest,
+) (*coredata.Data, error) {
+	now := time.Now()
+	datumID := gid.New(s.svc.scope.GetTenantID(), coredata.DatumEntityType)
+
+	datum := &coredata.Data{
+		ID:              datumID,
+		OrganizationID:  req.OrganizationID,
+		Name:            req.Name,
+		DataSensitivity: req.DataSensitivity,
+		OwnerID:         req.OwnerID,
+		CreatedAt:       now,
+		UpdatedAt:       now,
+	}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			return datum.CreateWithVendors(ctx, conn, s.svc.scope, req.VendorIDs, now)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return datum, nil
+}
+
+func (s DatumService) Delete(
+	ctx context.Context,
+	datumID gid.GID,
+) error {
+	datum := &coredata.Data{ID: datumID}
+
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return datum.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
+func (s DatumService) ListVendors(
+	ctx context.Context,
+	datumID gid.GID,
+	cursor *page.Cursor[coredata.VendorOrderField],
+) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
+	var vendors coredata.Vendors
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendors.LoadByDatumID(ctx, conn, s.svc.scope, datumID, cursor)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(vendors, cursor), nil
+}
+
+func (s VendorService) ListForDatumID(
+	ctx context.Context,
+	datumID gid.GID,
+	cursor *page.Cursor[coredata.VendorOrderField],
+) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
+	var vendors coredata.Vendors
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return vendors.LoadByDatumID(
+				ctx,
+				conn,
+				s.svc.scope,
+				datumID,
+				cursor,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(vendors, cursor), nil
+}
--- a/pkg/probo/service.go
+++ b/pkg/probo/service.go
@@ -60,6 +60,7 @@ type (
 		VendorComplianceReports *VendorComplianceReportService
 		Connectors              *ConnectorService
 		Assets                  *AssetService
+		Data                    *DatumService
 	}
 )

@@ -131,5 +132,6 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.VendorComplianceReports = &VendorComplianceReportService{svc: tenantService}
 	tenantService.Connectors = &ConnectorService{svc: tenantService}
 	tenantService.Assets = &AssetService{svc: tenantService}
+	tenantService.Data = &DatumService{svc: tenantService}
 	return tenantService
 }
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -245,10 +245,10 @@ enum VendorComplianceReportOrderField
    )
 }

-enum OrganizationOrderField {
-  NAME
-  CREATED_AT
-  UPDATED_AT
+enum OrganizationOrderField @goModel(model: "github.com/getprobo/probo/pkg/coredata.OrganizationOrderField") {
+  NAME @goEnum(value: "github.com/getprobo/probo/pkg/coredata.OrganizationOrderFieldName")
+  CREATED_AT @goEnum(value: "github.com/getprobo/probo/pkg/coredata.OrganizationOrderFieldCreatedAt")
+  UPDATED_AT @goEnum(value: "github.com/getprobo/probo/pkg/coredata.OrganizationOrderFieldUpdatedAt")
 }

 enum ConnectorOrderField
@@ -360,6 +360,12 @@ enum AssetOrderField @goModel(model: "github.com/getprobo/probo/pkg/coredata.Ass
  CRITICITY @goEnum(value: "github.com/getprobo/probo/pkg/coredata.AssetOrderFieldCriticity")
 }

+enum DatumOrderField @goModel(model: "github.com/getprobo/probo/pkg/coredata.DatumOrderField") {
+  CREATED_AT @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DatumOrderFieldCreatedAt")
+  NAME @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DatumOrderFieldName")
+  DATA_SENSITIVITY @goEnum(value: "github.com/getprobo/probo/pkg/coredata.DatumOrderFieldDataSensitivity")
+}
+
 # Order Input Types
 input UserOrder
  @goModel(
@@ -557,6 +563,14 @@ type Organization implements Node {
    orderBy: AssetOrder
  ): AssetConnection! @goField(forceResolver: true)

+  data(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: DatumOrder
+  ): DatumConnection! @goField(forceResolver: true)
+
  createdAt: Datetime!
  updatedAt: Datetime!
 }
@@ -1023,6 +1037,16 @@ type DocumentVersionEdge {
  node: DocumentVersion!
 }

+type DatumConnection {
+  edges: [DatumEdge!]!
+  pageInfo: PageInfo!
+}
+
+type DatumEdge {
+  cursor: CursorKey!
+  node: Datum!
+}
+
 # Root Types
 type Query {
  node(id: ID!): Node!
@@ -1157,6 +1181,12 @@ type Mutation {
  deleteAsset(input: DeleteAssetInput!): DeleteAssetPayload!
  addAssetVendor(input: AddAssetVendorInput!): AddAssetVendorPayload!
  removeAssetVendor(input: RemoveAssetVendorInput!): RemoveAssetVendorPayload!
+
+  createDatum(input: CreateDatumInput!): CreateDatumPayload!
+  updateDatum(input: UpdateDatumInput!): UpdateDatumPayload!
+  deleteDatum(input: DeleteDatumInput!): DeleteDatumPayload!
+  addDatumVendor(input: AddDatumVendorInput!): AddDatumVendorPayload!
+  removeDatumVendor(input: RemoveDatumVendorInput!): RemoveDatumVendorPayload!
 }

 # Input Types
@@ -1954,3 +1984,75 @@ type AddAssetVendorPayload {
 type RemoveAssetVendorPayload {
  asset: Asset!
 }
+
+type Datum implements Node {
+  id: ID!
+  name: String!
+  dataSensitivity: DataSensitivity!
+  owner: People! @goField(forceResolver: true)
+  vendors(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: VendorOrder
+  ): VendorConnection! @goField(forceResolver: true)
+  organization: Organization! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+input DatumOrder {
+  direction: OrderDirection!
+  field: DatumOrderField!
+}
+
+input CreateDatumInput {
+  organizationId: ID!
+  name: String!
+  dataSensitivity: DataSensitivity!
+  ownerId: ID!
+  vendorIds: [ID!]
+}
+
+input UpdateDatumInput {
+  id: ID!
+  name: String
+  dataSensitivity: DataSensitivity
+  ownerId: ID
+  vendorIds: [ID!]
+}
+
+input DeleteDatumInput {
+  datumId: ID!
+}
+
+input AddDatumVendorInput {
+  datumId: ID!
+  vendorId: ID!
+}
+
+input RemoveDatumVendorInput {
+  datumId: ID!
+  vendorId: ID!
+}
+
+type CreateDatumPayload {
+  datumEdge: DatumEdge!
+}
+
+type UpdateDatumPayload {
+  datum: Datum!
+}
+
+type DeleteDatumPayload {
+  deletedDatumId: ID!
+}
+
+type AddDatumVendorPayload {
+  datum: Datum!
+}
+
+type RemoveDatumVendorPayload {
+  datum: Datum!
+}
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
--- a/pkg/server/api/console/v1/types/data.go
+++ b/pkg/server/api/console/v1/types/data.go
@@ -0,0 +1,36 @@
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+func NewDatum(d *coredata.Data) *Datum {
+	return &Datum{
+		ID:              d.ID,
+		Name:            d.Name,
+		DataSensitivity: d.DataSensitivity,
+		CreatedAt:       d.CreatedAt,
+		UpdatedAt:       d.UpdatedAt,
+		Organization:    &Organization{ID: d.OrganizationID},
+	}
+}
+
+func NewDatumEdge(d *coredata.Data, orderField coredata.DatumOrderField) *DatumEdge {
+	return &DatumEdge{
+		Node:   NewDatum(d),
+		Cursor: d.CursorKey(orderField),
+	}
+}
+
+func NewDataConnection(page *page.Page[*coredata.Data, coredata.DatumOrderField]) *DatumConnection {
+	edges := make([]*DatumEdge, len(page.Data))
+	for i, data := range page.Data {
+		edges[i] = NewDatumEdge(data, page.Cursor.OrderBy.Field)
+	}
+
+	return &DatumConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(page),
+	}
+}
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -3,10 +3,6 @@
 package types

 import (
-	"bytes"
-	"fmt"
-	"io"
-	"strconv"
 	"time"

 	"github.com/99designs/gqlgen/graphql"
@@ -29,6 +25,15 @@ type AddAssetVendorPayload struct {
 	Asset *Asset `json:"asset"`
 }

+type AddDatumVendorInput struct {
+	DatumID  gid.GID `json:"datumId"`
+	VendorID gid.GID `json:"vendorId"`
+}
+
+type AddDatumVendorPayload struct {
+	Datum *Datum `json:"datum"`
+}
+
 type AssessVendorInput struct {
 	ID         gid.GID `json:"id"`
 	WebsiteURL string  `json:"websiteUrl"`
@@ -173,6 +178,18 @@ type CreateControlMeasureMappingPayload struct {
 	MeasureEdge *MeasureEdge `json:"measureEdge"`
 }

+type CreateDatumInput struct {
+	OrganizationID  gid.GID                  `json:"organizationId"`
+	Name            string                   `json:"name"`
+	DataSensitivity coredata.DataSensitivity `json:"dataSensitivity"`
+	OwnerID         gid.GID                  `json:"ownerId"`
+	VendorIds       []gid.GID                `json:"vendorIds,omitempty"`
+}
+
+type CreateDatumPayload struct {
+	DatumEdge *DatumEdge `json:"datumEdge"`
+}
+
 type CreateDocumentInput struct {
 	OrganizationID gid.GID               `json:"organizationId"`
 	Title          string                `json:"title"`
@@ -341,6 +358,35 @@ type CreateVendorRiskAssessmentPayload struct {
 	VendorRiskAssessmentEdge *VendorRiskAssessmentEdge `json:"vendorRiskAssessmentEdge"`
 }

+type Datum struct {
+	ID              gid.GID                  `json:"id"`
+	Name            string                   `json:"name"`
+	DataSensitivity coredata.DataSensitivity `json:"dataSensitivity"`
+	Owner           *People                  `json:"owner"`
+	Vendors         *VendorConnection        `json:"vendors"`
+	Organization    *Organization            `json:"organization"`
+	CreatedAt       time.Time                `json:"createdAt"`
+	UpdatedAt       time.Time                `json:"updatedAt"`
+}
+
+func (Datum) IsNode()             {}
+func (this Datum) GetID() gid.GID { return this.ID }
+
+type DatumConnection struct {
+	Edges    []*DatumEdge `json:"edges"`
+	PageInfo *PageInfo    `json:"pageInfo"`
+}
+
+type DatumEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Datum         `json:"node"`
+}
+
+type DatumOrder struct {
+	Direction page.OrderDirection      `json:"direction"`
+	Field     coredata.DatumOrderField `json:"field"`
+}
+
 type DeleteAssetInput struct {
 	AssetID gid.GID `json:"assetId"`
 }
@@ -369,6 +415,14 @@ type DeleteControlMeasureMappingPayload struct {
 	DeletedMeasureID gid.GID `json:"deletedMeasureId"`
 }

+type DeleteDatumInput struct {
+	DatumID gid.GID `json:"datumId"`
+}
+
+type DeleteDatumPayload struct {
+	DeletedDatumID gid.GID `json:"deletedDatumId"`
+}
+
 type DeleteDocumentInput struct {
 	DocumentID gid.GID `json:"documentId"`
 }
@@ -700,6 +754,7 @@ type Organization struct {
 	Risks      *RiskConnection      `json:"risks"`
 	Tasks      *TaskConnection      `json:"tasks"`
 	Assets     *AssetConnection     `json:"assets"`
+	Data       *DatumConnection     `json:"data"`
 	CreatedAt  time.Time            `json:"createdAt"`
 	UpdatedAt  time.Time            `json:"updatedAt"`
 }
@@ -718,8 +773,8 @@ type OrganizationEdge struct {
 }

 type OrganizationOrder struct {
-	Direction page.OrderDirection    `json:"direction"`
-	Field     OrganizationOrderField `json:"field"`
+	Direction page.OrderDirection             `json:"direction"`
+	Field     coredata.OrganizationOrderField `json:"field"`
 }

 type PageInfo struct {
@@ -776,6 +831,15 @@ type RemoveAssetVendorPayload struct {
 	Asset *Asset `json:"asset"`
 }

+type RemoveDatumVendorInput struct {
+	DatumID  gid.GID `json:"datumId"`
+	VendorID gid.GID `json:"vendorId"`
+}
+
+type RemoveDatumVendorPayload struct {
+	Datum *Datum `json:"datum"`
+}
+
 type RemoveUserInput struct {
 	OrganizationID gid.GID `json:"organizationId"`
 	UserID         gid.GID `json:"userId"`
@@ -903,6 +967,18 @@ type UpdateAssetPayload struct {
 	Asset *Asset `json:"asset"`
 }

+type UpdateDatumInput struct {
+	ID              gid.GID                   `json:"id"`
+	Name            *string                   `json:"name,omitempty"`
+	DataSensitivity *coredata.DataSensitivity `json:"dataSensitivity,omitempty"`
+	OwnerID         *gid.GID                  `json:"ownerId,omitempty"`
+	VendorIds       []gid.GID                 `json:"vendorIds,omitempty"`
+}
+
+type UpdateDatumPayload struct {
+	Datum *Datum `json:"datum"`
+}
+
 type UpdateDocumentInput struct {
 	ID           gid.GID                `json:"id"`
 	Title        *string                `json:"title,omitempty"`
@@ -1181,60 +1257,3 @@ type Viewer struct {
 	User          *User                   `json:"user"`
 	Organizations *OrganizationConnection `json:"organizations"`
 }
-
-type OrganizationOrderField string
-
-const (
-	OrganizationOrderFieldName      OrganizationOrderField = "NAME"
-	OrganizationOrderFieldCreatedAt OrganizationOrderField = "CREATED_AT"
-	OrganizationOrderFieldUpdatedAt OrganizationOrderField = "UPDATED_AT"
-)
-
-var AllOrganizationOrderField = []OrganizationOrderField{
-	OrganizationOrderFieldName,
-	OrganizationOrderFieldCreatedAt,
-	OrganizationOrderFieldUpdatedAt,
-}
-
-func (e OrganizationOrderField) IsValid() bool {
-	switch e {
-	case OrganizationOrderFieldName, OrganizationOrderFieldCreatedAt, OrganizationOrderFieldUpdatedAt:
-		return true
-	}
-	return false
-}
-
-func (e OrganizationOrderField) String() string {
-	return string(e)
-}
-
-func (e *OrganizationOrderField) UnmarshalGQL(v any) error {
-	str, ok := v.(string)
-	if !ok {
-		return fmt.Errorf("enums must be strings")
-	}
-
-	*e = OrganizationOrderField(str)
-	if !e.IsValid() {
-		return fmt.Errorf("%s is not a valid OrganizationOrderField", str)
-	}
-	return nil
-}
-
-func (e OrganizationOrderField) MarshalGQL(w io.Writer) {
-	fmt.Fprint(w, strconv.Quote(e.String()))
-}
-
-func (e *OrganizationOrderField) UnmarshalJSON(b []byte) error {
-	s, err := strconv.Unquote(string(b))
-	if err != nil {
-		return err
-	}
-	return e.UnmarshalGQL(s)
-}
-
-func (e OrganizationOrderField) MarshalJSON() ([]byte, error) {
-	var buf bytes.Buffer
-	e.MarshalGQL(&buf)
-	return buf.Bytes(), nil
-}
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -146,6 +146,60 @@ func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, fir
 	return types.NewDocumentConnection(page), nil
 }

+// Owner is the resolver for the owner field.
+func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.People, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	data, err := svc.Data.Get(ctx, obj.ID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get datum: %w", err)
+	}
+
+	people, err := svc.Peoples.Get(ctx, data.OwnerID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get owner: %w", err)
+	}
+
+	return types.NewPeople(people), nil
+}
+
+// Vendors is the resolver for the vendors field.
+func (r *datumResolver) Vendors(ctx context.Context, obj *types.Datum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorOrderBy) (*types.VendorConnection, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
+		Field:     coredata.VendorOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Data.ListVendors(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list data vendors: %w", err))
+	}
+
+	return types.NewVendorConnection(page), nil
+}
+
+// Organization is the resolver for the organization field.
+func (r *datumResolver) Organization(ctx context.Context, obj *types.Datum) (*types.Organization, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	org, err := svc.Organizations.Get(ctx, obj.Organization.ID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot get organization: %w", err)
+	}
+
+	return types.NewOrganization(org), nil
+}
+
 // Owner is the resolver for the owner field.
 func (r *documentResolver) Owner(ctx context.Context, obj *types.Document) (*types.People, error) {
 	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
@@ -1687,6 +1741,71 @@ func (r *mutationResolver) RemoveAssetVendor(ctx context.Context, input types.Re
 	panic(fmt.Errorf("not implemented: RemoveAssetVendor - removeAssetVendor"))
 }

+// CreateDatum is the resolver for the createDatum field.
+func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDatumInput) (*types.CreateDatumPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.OrganizationID.TenantID())
+
+	data, err := svc.Data.Create(ctx, probo.CreateDatumRequest{
+		OrganizationID:  input.OrganizationID,
+		Name:            input.Name,
+		DataSensitivity: input.DataSensitivity,
+		OwnerID:         input.OwnerID,
+		VendorIDs:       input.VendorIds,
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot create datum: %w", err)
+	}
+
+	return &types.CreateDatumPayload{
+		DatumEdge: types.NewDatumEdge(data, coredata.DatumOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateDatum is the resolver for the updateDatum field.
+func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDatumInput) (*types.UpdateDatumPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.ID.TenantID())
+
+	datum, err := svc.Data.Update(ctx, probo.UpdateDatumRequest{
+		ID:              input.ID,
+		Name:            input.Name,
+		DataSensitivity: input.DataSensitivity,
+		OwnerID:         input.OwnerID,
+		VendorIDs:       input.VendorIds,
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot update datum: %w", err)
+	}
+
+	return &types.UpdateDatumPayload{
+		Datum: types.NewDatum(datum),
+	}, nil
+}
+
+// DeleteDatum is the resolver for the deleteDatum field.
+func (r *mutationResolver) DeleteDatum(ctx context.Context, input types.DeleteDatumInput) (*types.DeleteDatumPayload, error) {
+	svc := GetTenantService(ctx, r.proboSvc, input.DatumID.TenantID())
+
+	if err := svc.Data.Delete(ctx, input.DatumID); err != nil {
+		return nil, fmt.Errorf("cannot delete datum: %w", err)
+	}
+
+	return &types.DeleteDatumPayload{
+		DeletedDatumID: input.DatumID,
+	}, nil
+}
+
+// AddDatumVendor is the resolver for the addDatumVendor field.
+func (r *mutationResolver) AddDatumVendor(ctx context.Context, input types.AddDatumVendorInput) (*types.AddDatumVendorPayload, error) {
+	panic(fmt.Errorf("not implemented: AddDatumVendor - addDatumVendor"))
+}
+
+// RemoveDatumVendor is the resolver for the removeDatumVendor field.
+func (r *mutationResolver) RemoveDatumVendor(ctx context.Context, input types.RemoveDatumVendorInput) (*types.RemoveDatumVendorPayload, error) {
+	panic(fmt.Errorf("not implemented: RemoveDatumVendor - removeDatumVendor"))
+}
+
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
 	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
@@ -1942,6 +2061,31 @@ func (r *organizationResolver) Assets(ctx context.Context, obj *types.Organizati
 	return types.NewAssetConnection(page), nil
 }

+// Assets is the resolver for the assets field.
+func (r *organizationResolver) Data(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DatumOrder) (*types.DatumConnection, error) {
+	svc := GetTenantService(ctx, r.proboSvc, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.DatumOrderField]{
+		Field:     coredata.DatumOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.DatumOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	page, err := svc.Data.ListForOrganizationID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list organization data: %w", err))
+	}
+
+	return types.NewDataConnection(page), nil
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	svc := GetTenantService(ctx, r.proboSvc, id.TenantID())
@@ -2039,6 +2183,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			panic(fmt.Errorf("cannot get asset: %w", err))
 		}
 		return types.NewAsset(asset), nil
+	case coredata.DatumEntityType:
+		datum, err := svc.Data.Get(ctx, id)
+		if err != nil {
+			panic(fmt.Errorf("cannot get data: %w", err))
+		}
+		return types.NewDatum(datum), nil
 	default:
 	}

@@ -2452,6 +2602,9 @@ func (r *Resolver) Asset() schema.AssetResolver { return &assetResolver{r} }
 // Control returns schema.ControlResolver implementation.
 func (r *Resolver) Control() schema.ControlResolver { return &controlResolver{r} }

+// Datum returns schema.DatumResolver implementation.
+func (r *Resolver) Datum() schema.DatumResolver { return &datumResolver{r} }
+
 // Document returns schema.DocumentResolver implementation.
 func (r *Resolver) Document() schema.DocumentResolver { return &documentResolver{r} }

@@ -2510,6 +2663,7 @@ func (r *Resolver) Viewer() schema.ViewerResolver { return &viewerResolver{r} }

 type assetResolver struct{ *Resolver }
 type controlResolver struct{ *Resolver }
+type datumResolver struct{ *Resolver }
 type documentResolver struct{ *Resolver }
 type documentVersionResolver struct{ *Resolver }
 type documentVersionSignatureResolver struct{ *Resolver }