All Products
Search
Document Center

Data Management:Use data watermarks

Last Updated:Mar 28, 2026

Data Management (DMS) lets you embed a watermark in exported files or extract a watermark from an external file based on your business requirements. Use watermarks to trace data during its spread and distribution, and when a leak is detected, extract the watermark to identify who exported the file and when.

Prerequisites

Before you begin, ensure that you have:

Watermark types

DMS supports two watermark types with different visibility and use cases:

TypeVisibilityDescription
Data watermarkImperceptible to viewersIdentification information is embedded directly into data values, leaving no visible trace
File watermarkVisible to viewersIdentification information is embedded as visible markings in the exported file

The embedded watermark contains the username and the export time. After extracting a watermark, these two fields identify who exported the data and when.

Constraints

  • For reliable embedding, export more than 200 data entries. Watermark extraction may fail for files with fewer entries.

  • When extracting a watermark, the file must contain more than 200 data entries.

Embed watermarks

DMS provides two ways to embed watermarks in exported SQL result sets:

  • Global configuration (recommended): Enable watermarks tenant-wide via Configuration Management. All SQL result set exports within the tenant automatically include a watermark.

  • Per-ticket configuration: Enable watermarks when creating an individual SQL Result Set Export ticket.

Enable watermarks globally

Global configuration applies watermarks automatically to all SQL result set exports, without requiring individual ticket configuration. The watermark consists of the username and the export time. By default, the exported result sets are Excel files.

After you enable global watermarks, the Embed Watermark parameter is no longer displayed when creating a SQL Result Set Export ticket.
  1. Log on to the DMS console V5.0.

  2. In the top navigation bar, choose O&M > Configuration Management.

    In simple mode, move the pointer over the 2023-01-28_15-57-17.png icon in the upper-left corner and choose All Features > O&M > Configuration Management.
  3. Enter a keyword in the search box and click the search icon.

    image.png

  4. Find the Watermark for Exported SQL Result Sets parameter and click Change in the Actions column.

  5. In the Change Parameter Configuration dialog box, enter Y in the Value field and click Confirm Change.

Embed a watermark when creating a ticket

Use this approach to embed a watermark on a specific export without enabling global watermarks.

  1. Log on to the DMS console V5.0.

  2. In the top navigation bar, choose Database Development > Data Export > SQL Result Set Export.

  3. On the SQL Result Set Export tab, configure the following parameters.

    ParameterRequiredDescription
    Database NameYesThe database from which to export the SQL result set. You must have export permissions for this database. See View owned permissions.
    Reason CategoryYesThe reason for this export. Used to locate the ticket in subsequent operations.
    Business BackgroundYesThe purpose or objective of this export. Reduces unnecessary communication.
    Affected RowsYesThe estimated number of rows to export. To get the actual count, run COUNT on the SQL statements in SQLConsole. DMS displays the actual number in the Precheck step for your review.
    Skip ValidationNoWhether to skip row count validation. If selected, specify the reason.
    Warning

    Skipping validation means DMS will not check the number of rows affected. Use with caution for large exports.

    StakeholderNoUsers who can view the ticket and participate in approval. Users not listed (except DMS administrators and DBAs) cannot access the ticket.
    Export StatementYesThe SQL statements to execute. Only SELECT statements are supported. DMS validates syntax on submission.
    Embed WatermarkYesWhether to embed a watermark in the exported file. Select Yes to enable.
    Embedding MethodYesHow the watermark is embedded. Valid values: Data Watermark (imperceptible to viewers) or File Watermark (visible to viewers).
    Data Watermark Message or File Watermark MessageYesThe identification information to embed as the watermark.
    Embedded FieldNoThe field into which the watermark is embedded. If left blank, DMS selects a field automatically.
    Primary key / Unique KeyNoOne or more primary or unique keys, separated by commas (,). Specifying this parameter makes watermark extraction more reliable.
    AttachmentsNoImages or files that provide additional context for this export.
  4. Click Submit. DMS runs a precheck on the SQL statements. Wait for the precheck to complete.

  5. Click Submit for Approval and wait for approval. Track approval progress in the Approval step on the Ticket Details page.

  6. After the ticket is approved, export the file within 24 hours. After this window expires, the ticket can no longer be used and you must create a new SQL Result Set Export ticket.

    If the database is managed in Security Collaboration mode, you can adjust this window. Go to the security rule set Details page, click Data Export in the left-side bar, and edit the Period for Performing Export after Export Request of SQL Result Set Is Approved configuration item.
  7. In the Execute/Automatic Execution step, click Export.

  8. In the Export Settings dialog box, configure the following parameters.

    ParameterRequiredDescription
    FormatYesThe file format. Valid values: CSV, EXCEL, SQL, JSON. JSON is available only for NoSQL databases. Set this to EXCEL when embedding a watermark.
    Character SetYesThe character set of the exported file. Valid values: Default Character Set, GBK, UTF-8, ISO-8859-1.
    Execution StrategyYesWhen to export the file. Running immediately starts the export right away. Schedule exports the file at a specified time—useful for off-peak hours. Configurations cannot be changed after selecting Schedule.
    Export ModeYesSpeed Mode: The export cannot be stopped before it completes. Ordinary Mode: The export can be stopped during execution.
    Export TimeNoThe timeout period for the export task, in seconds. Valid values: 0 to 2,147,483. If not specified, the instance-level timeout applies. If the task exceeds this period without completing, it fails. See Register an Alibaba Cloud database instance for instance-level timeout settings.
    Add Field CommentNoAvailable only for MySQL databases with CSV format. When enabled, DMS adds field comments in the row next to the field names.
  9. After the file is exported, click Download Exported File to save it to your device.

Extract watermarks

Use watermark extraction to verify whether a file contains an embedded watermark and to retrieve the identification information it contains.

  1. Log on to the DMS console V5.0.

  2. In the top navigation bar, choose Security and Specifications > Data Watermark.

  3. On the Data Watermark tab, click Data Watermark in the upper-right corner to open the Data Watermark Tickets page.

  4. Configure the following parameters.

    ParameterRequiredDescription
    File TypeYesThe type of file to extract from. Valid values: CSV, EXCEL.
    FileYesClick File to upload the file. Only XLSX and CSV files are supported.
    Business BackgroundYesThe purpose of this extraction. Helps reduce unnecessary communication.
    Database NameNoThe database from which the uploaded file was originally exported.
    Primary key / Unique KeyNoThe same primary or unique keys specified when embedding the watermark. Using the same keys ensures extraction accuracy.
    Embedded FieldNoThe field into which the watermark was embedded.
  5. Click Submit.

  6. After the ticket is approved, click Execute in the Execute/Automatic Execution step.

After execution completes, view the extraction status and the details of the extracted watermark—including the username and export time that were embedded in the file.