Source: duckdb:demo.duckdb · Target: local:iceberg · Finding dated 2026-10-19 12:06, on the scope run · Canot 0.3.4
Exit feasible on this scope. 2 points to address before leaving.
These measurements describe this exercise, on this scope. They do not compare two platforms.
Destination: local:iceberg · location: …/iceberg/warehouse · catalog: SQLite (catalog.db in the output folder).
The copy is in Apache Iceberg format: you can reread it without Canot. The reread.sql file next to this report holds the DuckDB commands to do so.
| Table | Source rows | Target rows | Result | Details |
|---|---|---|---|---|
| tpch.customer | 150000 | 150000 | identical | |
| tpch.lineitem | 6001215 | 6001215 | precision | l_loaded_at.min: Timestamp('1992-01-31 00:00:00.287971001') / datetime.datetime(1992, 1, 31, 0, 0, 0, 287971); l_loaded_at.max: Timestamp('1998-10-31 00:00:05.354144001') / datetime.datetime(1998, 10, 31, 0, 0, 5, 354144) |
| tpch.nation | 25 | 25 | identical | |
| tpch.orders | 1500000 | 1500000 | identical | |
| tpch.part | 200000 | 200000 | identical | |
| tpch.partsupp | 800000 | 800000 | identical | |
| tpch.region | 5 | 5 | identical | |
| tpch.supplier | 10000 | 10000 | identical |
| Query | Result | Details |
|---|---|---|
select l_returnflag, l_linestatus, sum(l_quantity) as sum_qty, sum(l_extendedprice) as sum_base_price,
sum(l_extendedprice * (1 - l_d | match | |
select l_orderkey, sum(l_extendedprice * (1 - l_discount)) as revenue, o_orderdate
from tpch.customer, tpch.orders, tpch.lineitem
where c_mk | match | |
select sum(l_extendedprice * l_discount) as revenue from tpch.lineitem
where l_shipdate >= date '1994-01-01' and l_shipdate < date '1995-01- | match | |
select * from tpch.lineitem order by l_orderkey, l_linenumber limit 50 | mismatch | sorted row 0, column 16: Timestamp('1996-02-12 00:00:00.000001001') / datetime.datetime(1996, 2, 12, 0, 0, 0, 1) |
| tpch.lineitem.l_loaded_at | TIMESTAMP_NS → timestamp[us] | ns -> us (Iceberg v2 does not keep nanoseconds) (possible loss) |
Columns with a platform-specific type: 0. Objects to rebuild (views, procedures, tasks…):
| Type | Count | Examples |
|---|---|---|
| none detected | ||
These elements can support your own work on GDPR, DORA, NIS2, the Data Act, SecNumCloud or the EBA outsourcing guidelines. They are evidence, not a finding: this report is not a certification, it is not legal advice, and it does not say whether your contracts or your organization meet any regulation.
| Framework | What it asks, in short | What this report gives you | What it does not cover |
|---|---|---|---|
| DORA (Regulation (EU) 2022/2554) | Art. 28(8): exit plans for ICT services supporting the functions DORA targets are documented and tested. | The exit exercise itself: its date, its scope, what was copied and compared, what differs, in a signed log. | One exercise on one scope. DORA also expects periodic review and scenarios you define yourself. |
| DORA (Regulation (EU) 2022/2554) | Art. 28(8) and 30(3)(f): a realistic transition, with an adequate period. | Measured throughput and a recovery time range from the exercise; a copy duration range (estimated) in the scan. | Excludes human validation and the cutover of your applications. |
| DORA (Regulation (EU) 2022/2554) | Art. 28: knowing what depends on the ICT provider. | What does not move as is: views, routines, tasks, policies, external dependencies, with the evidence behind each finding. | An inventory of the platform, not of your contracts or of the applications connected to it. |
| Data Act (Regulation (EU) 2023/2854) | Arts. 23 to 31 (switching between data processing services); Art. 30: export in a structured, commonly used, machine-readable format. | A copy in Apache Iceberg, an open format, that can be reread without Canot (the reread.sql file next to the report). | Whether your provider meets its own obligations is a matter for your contract. |
| Data Act (Regulation (EU) 2023/2854) | Art. 29: switching charges are withdrawn from 12 January 2027. | The effort that remains yours: read cost, copy duration and rework estimates, each marked measured, computed or estimated. | Says nothing about charges your provider may still apply before that date. Prices are dated catalogue figures, not your contract. |
| GDPR (Regulation (EU) 2016/679) | Art. 5(2) accountability; Art. 28(3)(g): return or deletion of personal data at the end of the service. | A signed record of what was copied, when and to where. Any change to the log shows. | Does not cover deletion at the source. The signature attests integrity, not the author or the date. |
| GDPR (Regulation (EU) 2016/679) | Chapter V (transfers) and Art. 32 (security of processing). | Where the copy is hosted, and which security objects do not move with it (masking and row policies, tags). | The hosting location is the destination you chose. The legal assessment of a transfer is yours. |
| SecNumCloud (ANSSI) | The qualification concerns the provider's offer, and its referential includes reversibility requirements. | Where the copy lands (provider, region) so you can check that offer against the ANSSI list of qualified offers, and an open-format copy. | Canot does not assess or certify an offer. Qualification depends on the precise offer and is decided by ANSSI. |
| NIS2 (Directive (EU) 2022/2555) | Art. 21(2)(c): business continuity, including backup management and recovery. | Evidence that the data can be restored in an open format elsewhere: a copy compared with the source, and a recovery time range. | Not a backup or disaster-recovery plan. One exercise on one scope. |
| NIS2 (Directive (EU) 2022/2555) | Art. 21(2)(d): security of the supply chain, including your relationship with each direct service provider. | What ties you to this provider: external dependencies and objects that do not move as is, with the evidence behind each finding. | Does not assess the provider's security measures. |
| EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) | Exit strategies: documented, realistic, sufficiently tested and reviewed periodically for the outsourcing the guidelines target. | The exit exercise (drill) and the inventory of what does not move (scan), as test evidence in your exit file. | One exercise. Alternative providers, the business side and the periodic review are yours. Check which text applies to you alongside DORA. |
References as of 2026-10-19. Check the current texts: they evolve, and their application depends on your situation.
{"float_rel": 1e-09, "decimal_abs": 0.0, "columns": {}}
Chained log: 23 entries, last hash e42b281a6c763f86c475230d339b2907b844d42d487d0776f4812db9cb2544a9.
Any change to the log shows. Verification: canot verify-evidence evidence
Fingerprint of the public signing key: 47371597 1591e860 04c9cf93 0acc0d7d.
The signature attests the integrity of the log. It establishes neither the identity of the author nor the date: for that, keep the report in your own timestamped archive.
This report is a record of measurements for your own assessment. It is not a certification and it does not say whether your contracts or your organization meet any regulation.