For an on-prem SQL Server, the security question comes before any feature question: where does my data go? With a SaaS data quality tool, the answer usually involves the vendor’s cloud. It doesn’t have to.
What “no data leaves” requires
Three conditions, and a tool has to meet all of them:
| Condition | What to check |
|---|---|
| Checks run where the data is | The tool sends SQL to SQL Server, rather than pulling rows out to compute on them |
| Results stay on your infrastructure | The tool’s own database runs on a server you control |
| No vendor-hosted component | Nothing requires an account or connection to the vendor’s service |
How DataOps TestGen meets them
Checks run in SQL Server. Data profiling, tests, and monitors are T-SQL queries that TestGen pushes into the database, per its Access Requirements. It never runs INSERT, UPDATE, DELETE, CREATE, ALTER, or DROP, so a DBA can grant a SQL login with SELECT only.
Results stay with you. TestGen’s application database is PostgreSQL on the TestGen server. It holds configuration, results, and schedules: aggregates, statistics, and test outcomes. For display, data profiling also keeps each column’s most frequent values and minimum and maximum text values. That’s the one place values from your tables land, and it’s on your server.
Nothing is hosted by DataKitchen. From System Architecture and Security, checked November 3, 2026: TestGen runs entirely within your infrastructure, DataKitchen hosts no part of it, and it needs no connections from outside your network.
| Connection | Direction | Required? |
|---|---|---|
| SQL Server (read-only queries) | Outbound from TestGen | Yes |
| TestGen’s own database | Internal | Yes |
| Web UI | Inbound from your users | Yes |
| REST API and MCP server | Inbound | Optional |
| SMTP for alerts | Outbound to your mail server | Optional |
| Single sign-on (Enterprise) | Outbound to your identity provider | Optional |
| Anonymous usage analytics | Outbound | Optional; turn off |
Where to run it
On a Windows or Linux server, a VM, or a laptop on the same network as SQL Server. The Windows install uses dk-installer.exe. If TestGen runs in Docker on the SQL Server machine itself, use host.docker.internal as the host.
On a busy production server, start with one or two threads, as DataKitchen’s hotel reservation case study did on a 1.2 TB SQL Server database, or point TestGen at a readable replica.
The cloud alternative
Microsoft Purview Data Quality runs in Microsoft’s cloud. For on-premises SQL Server, its supported sources table, updated April 2026, lists data quality scans but no data profiling. See whether Purview works with on-prem SQL Server.
Open-source TestGen is free for one user, one connection, and one project. Start at the SQL Server install page, and see what data leaves your environment with an AI assistant if you plan to use TestGen’s MCP server.