Sensitive data classification for micro-service applications

A computing system comprising:

• one or more processor devices of one or more computing devices, wherein the one or more processor devices are configured to:
• receive, by a datastore layer service of a plurality of services that compose an application from an upstream service of the plurality of services, a request, the request being associated with a transaction submitted to the application, the request including a transaction identifier that uniquely identifies the transaction;
• initiate, by the datastore layer service in response to the request, a query against a datastore to obtain a data item based on information included in the request;
• analyze, by a sensitive data classifier, query information associated with the query;
• determine, by the sensitive data classifier, that the query requests a data item that has been classified as a sensitive data item;
• and
• in response to the determination that the query requests the data item that has been classified as a sensitive data item, cause, by the sensitive data classifier, the transaction identifier and classification information that indicates the query requested the data item that has been classified as a sensitive data item to be sent to a collector service,
• wherein the collector service receives the transaction identifier and the classification information, and stores the classification information in a datastore based on the transaction identifier, wherein the classification information is correlated with the transaction identifier and a security token in the datastore, the security token comprising an identity of an entity, associated with the transaction, that identifies and authorizes a transaction originator of the transaction prior to processing the transaction.

A non-transitory computer-readable storage medium that includes executable instructions configured to cause one or more processor devices to:

• receive, by a datastore layer service of a plurality of services that compose an application from an upstream service of the plurality of services, a request, the request being associated with a transaction submitted to the application, the request including a transaction identifier that uniquely identifies the transaction;
• initiate, by the datastore layer service in response to the request, a query against a datastore to obtain a data item based on information included in the request;
• analyze, by a sensitive data classifier, query information associated with the query;
• determine, by the sensitive data classifier, that the query requests a data item that has been classified as a sensitive data item;
• and
• in response to the determination that the query requests the data item that has been classified as a sensitive data item, cause, by the sensitive data classifier, the transaction identifier and classification information that indicates the query requested the data item that has been classified as a sensitive data item to be sent to a collector service,
• wherein the collector service receives the transaction identifier and the classification information, and stores the classification information in a datastore based on the transaction identifier, wherein the classification information is correlated with the transaction identifier and a security token in the datastore, the security token comprising an identity of an entity, associated with the transaction, that identifies and authorizes a transaction originator of the transaction prior to processing the transaction.