Exit scan: BigQuery

Scope

• Platform: BigQuery
• Scope: projects lab-a (data); regions EU, europe-west1, US
• Privilege level: 3 (+ privileges and tools (pseudonymized))
• SQL mode: read-only
• Reads: 18 done out of 22
• Content read: 9 tables, 12 objects, 4 query families
• Hidden schemas or datasets read: _tmp
• Versions: canot X, duckdb X, sqlglot X

Capabilities

This report is an inventory: inventoried, neither exported nor replayed.

BigQuery connector: tested; recorded test: canot drill, 2026-10-13: public dataset thelook_ecommerce (docs/ecarts.md).

What Canot cannot prove here: the declared forms (P1, P2) cover tables and queries; objects to rebuild besides tables are counted, not proven.

Observed costs

Window: 180 days. On-demand and reserved: two billing models, never added together.

On demand

Reserved

On demand and reserved do not add up: two billing models, two bases.

Storage

Movements

2 frozen, 7 live, 0 recreated, 0 not determined.

recreated: DDL less than 7 days old with no later write; live: write less than 30 days old; frozen: older last write; not determined: writes not read. Based on: B03, B04, B05, B07, B10, B11 ….

What does not leave with the copy

Objects to rebuild or describe

Routines per language: JAVASCRIPT 1, SQL 1.

Columns with a platform-specific type (3)

Billed history

Dependencies

External dependencies (F01)

Hidden external dependencies (F02)

Writes outside the platform (F03)

External consumers (F09)

Tools seen in queries

Query replayability

Based on: 1/3 families, window not read, sqlglot X, duckdb X.

accepted ≠ identical result. Translated to DuckDB, not compared.

1 family containing a secret, counted then set aside.

Platform-specific functions

Most executed families (normalized forms)

Ranges

Planning estimates: each range carries its assumptions. A canot drill replaces the assumed throughput with a measurement.

Findings

Each finding is labeled "To review", with no severity level. It states what is observed and what is not.

F01 · External dependencyTo review

2 findings

F02 · Hidden external dependencyTo review

1 finding

F03 · Write outside the platformTo review

2 findings

F05 · Storage with no observed readTo review

2 findings

F06 · Billed history that does not transferTo review

1 finding

F08 · Dynamic SQLTo review

1 finding

F09 · External consumersTo review

1 finding

F10 · Security to rebuildTo review

2 findings

F11 · Scheduled chain and its failuresTo review

4 findings

F12 · Incomplete readTo review

3 findings

No finding for: F04, F07. An absence of findings only holds for the reads done (see F12 and the method).

What this report does not quantify

• Average billed storage: not provided by collection.
• Storage cost: your contract price not read.
• Reserved, in dollars: your contract price not read.
• Copy read cost (Storage Read API, network egress): your contract price not read.
• Your contract rate: your contract price not read.
• Destination storage, running both platforms in parallel, operations after the exit: depend on your contract and your architecture.
• Identical results of translated queries: accepted ≠ identical result: translated to DuckDB, not compared; a canot drill compares the results.
• Cost projections provided by the platform: not used: they cannot be verified from the scan.
• BigQuery free tier: shared by the billing account, cannot be attributed per project.
• Reads through the Storage Read API: missing from INFORMATION_SCHEMA.JOBS.
• Billed bytes of queries under a row access policy: NULL value in INFORMATION_SCHEMA.JOBS.

Using this report for GDPR, DORA, the Data Act and SecNumCloud

These elements can support your own work on GDPR, DORA, the Data Act or SecNumCloud. They are evidence, not a finding: this report is not a certification, it is not legal advice, and it does not say whether your contracts or your organization meet any regulation.

References as of 2026-10-19. Check the current texts: they evolve, and their application depends on your situation.

Method

18 reads done out of 22. Each read is recorded with its status and its reason; a value that was not read stays empty, never 0.

… and 2 more in reads.csv.

Privileges used

Level 3: bigquery.jobs.create, jobs.listAll, datasets.get, tables.list, tables.get, routines.list, routines.get, models.list, models.getMetadata, rowAccessPolicies.list, transfers.get, connections.list, dataPolicies.list (optional), reservations.list, reservationAssignments.list, capacityCommitments.list, organization-level permissions. Never requested: tables.getData, bigquery.user and jobUser roles.

Cost of the scan

Safeguards

• Every SQL statement sent goes through a read-only guard: only SELECT, SHOW, DESCRIBE and ALTER SESSION SET statements go out. No write, no API activation, no parameter change.
• Query users and roles pseudonymized with HMAC, using a salt drawn for this scan and never written; tag values hashed; locations reduced to the bucket.
• Raw SQL text is never written: only normalized forms, with literals masked, leave collection.

Rules

• Movement: recreated: DDL less than 7 days old with no later write; live: write less than 30 days old; frozen: older last write; not determined: writes not read.
• Storage with no read: actual window of the view read, compared with 180 days; the blind spots of each view are listed in the finding.
• Copy time: assumed throughput of 20 to 80 MB/s.
• List prices are dated and sourced; they do not replace your contract price.