Policy Engine: the runtime API for every data decision

Today we're introducing Policy Engine, a runtime API that turns every if/then your business runs on into a real-time data decision.

Every AI initiative you ship, every personalization campaign you launch, and every new data use case depends on one question: can I use this data, right now, for this purpose? AI and rich consumer data are handing businesses more growth opportunities than ever, but capturing that value takes new tools built for speed and certainty.

Today, nothing answers that reliably, quickly, or at scale. Business policy (don't advertise a product to someone whose behavior suggests they're trying to quit it) has no system built for that speed. Add regulatory context (an age-gate, a consent-expiry window) and customer permissions (opted in for email, opted out of sale), and now three inputs all have to agree before a decision is safe to make. Nothing checks that they do.

Policy Engine is the infrastructure layer that brings business policy, regulatory context, and customer permissions together into every data decision your business makes. It's the foundation of a category we think businesses need today: Data Decision Infrastructure.

The problem: three separate contexts, no shared system

For years, businesses have navigated three different contexts for every data decision: business policy, regulations and legal requirements, and customer preferences. Each matters. Each comes from a different place. Each has historically been handled by a different system.

Say a customer opts into marketing with one brand in your portfolio. Does that consent extend to your other brands, or does each one need its own? That depends on how your business defines the relationship between those brands, whether either brand operates in a jurisdiction that treats them as legally distinct, and what the customer actually agreed to. Answering that one question today means checking three systems and hoping they agree.

The number of contexts is exploding, and AI removes the room for manual checks

Data decisioning didn't need infrastructure when enterprises held a modest amount of customer data, in a handful of places, under a handful of rules. None of that holds anymore.

Customer data is exploding, and businesses want to do more with it: combine cross-brand, cross-channel data to build things like retail media networks or loyalty programs, or use a service failure to suppress marketing to someone who just had a bad experience. Regulation is expanding too, as businesses operate across more jurisdictions and new privacy and AI-specific laws layer on top of existing ones. Business policy also keeps growing more complex on its own, as more teams build more rules for more edge cases than any one system was built to track.

AI adds a multiplier on top of all three: it doesn't just create new data, it creates new decisions, at a volume and speed no team can check by hand. Every new feature is a new "can I use this data for this" question, arriving faster than any manual process can answer it.

Data decisions require more than privacy and consent

Legacy consent tools solve for narrow privacy concepts. Some also layer in legal requirements. None of them can contemplate the rules and policies an organization actually runs on, because those are specific to each business, not something a CMP is built to encode.

A lawyer can write the policy. But making sure it's actually applied, correctly, everywhere data flows, is bigger than any one team can guarantee alone. That's an infrastructure problem, and it belongs with the CIO and CTO who are leading AI transformation, alongside the teams already building the systems that need to respect it.

Policy Engine is built for that layer: if you can state the if/then, Policy Engine can encode it and automate the decision, wherever it originates.

How Policy Engine works

Policy Engine operates as a runtime API, not as a gateway. Your systems call Policy Engine only at the moment a decision actually has to be made, and your rules have to be respected. It's built to sit alongside the rest of your stack, not at the center of it, and it's agnostic to where your data lives whether that’s a data lake, a warehouse, or any other system already in place. With this approach, every business policy, customer preference, and legal requirement gets encoded the same way: as a simple if/then statement.

Every rule you have is really an if/then statement: if this condition is true, take this action. Policy Engine takes that logic and runs it the moment a system or agent asks, checking the condition against real-time context and returning a decision in milliseconds, every time, everywhere that rule applies. Because every decision runs through one engine, it's also automatically auditable: each decision is logged as it's computed, not reconstructed after the fact.

Knowing whether you can use a piece of data also depends on knowing where that data lives and how it's classified, structured or unstructured. Policy Engine works alongside Data Discovery and Classification, so every decision is grounded in data you can actually account for. It also connects directly to Preference Management and Consent, so every customer permission feeds straight into the decision, and to Rules Automation for teams managing policy logic at scale. Because every decision runs through Sombra, the data behind it stays as secured as the rest of your Transcend stack.

Already helping the Fortune 500 make responsible data decisions

In use with multiple Fortune 500 companies, all existing Transcend customers, spanning diverse industries. Each hit the same "can I use this data" wall from a different direction: business policy, regulatory context, and customer permissions all had to agree at once, and no system was built to check them together. Different industries, different starting problems, same missing layer underneath.

A corporation operating several store brands needed one answer for whether a customer's consent given to one brand could be extended to another, and evaluated together with region and brand relationship (instead of hard-coded separately into each brand's systems).

A retailer had the opposite version of the same problem: data use rules scattered across CDPs and data warehouses with no central enforcement point. Centralizing that logic enabled them to expand personalization and retail media initiatives without re-litigating permission logic every time an ad was served.

A pharmaceutical company expanding into D2C faced the hardest version of that problem. Multiple rules applied to the same decision at once: what the company's own policy allowed, what regulation required, and what the customer agreed to. A simple yes or no wasn't enough. They also needed to prove why: whether an "allowed" came from the customer's explicit choice or from a jurisdiction's default rule. In a regulated industry, that distinction is something they may have to defend.

The bigger picture

Data Decision Infrastructure is what businesses need once "can I use this data, right now, for this purpose?" stops being a question one team can answer manually, and starts being a question every system needs answered instantly and programmatically. It's the same problem Transcend has always tackled for the largest and most complex global brands: encoding what's allowed directly into the systems that use data, so growth doesn't have to be traded for risk. Policy Engine extends that to every context your business runs on.