Production Readiness Roadmap

Version: 1.0 | Date: February 2026 | Status: Living Document

This roadmap addresses the infrastructure, operations, security, compliance, and ecosystem maturity required to transition DataSynth from a feature-complete beta to a production-grade enterprise platform. It complements the existing feature roadmap which covers domain-specific enhancements.

Table of Contents

• Current State Assessment
• Phase 1: Foundation (0-3 months)
• Phase 2: Hardening (3-6 months)
• Phase 3: Enterprise Grade (6-12 months)
• Phase 4: Market Leadership (12-18 months)
• Industry & Research Context
• Competitive Positioning
• Regulatory Landscape
• Risk Register

Current State Assessment

Production Readiness Scorecard (v0.5.0 — Phase 2 Complete)

Overall: 9.4/10 — Enterprise-grade with Kubernetes deployment, formal privacy guarantees, panic-free library code, comprehensive operations documentation, and data lineage tracking. Remaining gaps: RBAC/OAuth2, plugin SDK, Python async support.

Phase 1: Foundation (0-3 months)

Goal: Establish the minimum viable production infrastructure.

1.1 Containerization & Packaging

Priority: Critical | Effort: Medium

Implementation Notes:

# Target image structure
FROM rust:1.88-bookworm AS builder
# ... build with --release
FROM gcr.io/distroless/cc-debian12
COPY --from=builder /app/target/release/datasynth-server /
EXPOSE 3000
ENTRYPOINT ["/datasynth-server"]

1.2 Security Hardening

Priority: Critical | Effort: Medium

1.3 Observability Stack

Priority: Critical | Effort: Medium

Key Metrics to Instrument:

• datasynth_generation_entries_total (Counter) — Total entries generated
• datasynth_generation_duration_seconds (Histogram) — Per-phase latency
• datasynth_generation_errors_total (Counter) — Errors by type
• datasynth_memory_usage_bytes (Gauge) — Current memory consumption
• datasynth_active_sessions (Gauge) — Concurrent generation sessions
• datasynth_api_request_duration_seconds (Histogram) — API latency by endpoint

1.4 CI/CD Hardening

Priority: High | Effort: Low

Phase 2: Hardening (3-6 months)

Goal: Enterprise-grade reliability, scalability, and compliance foundations.

2.1 Scalability & High Availability

Priority: High | Effort: High

2.2 Data Lineage & Provenance

Priority: High | Effort: Medium

Rationale: Data lineage is becoming a regulatory requirement under the EU AI Act (Article 10 — data governance for training data) and is a key differentiator in the enterprise synthetic data market. NIST AI RMF 1.0 also emphasizes provenance tracking under its MAP and MEASURE functions.

2.3 Enhanced Privacy Guarantees

Priority: High | Effort: High

Research Context: The NIST SP 800-226 (Guidelines for Evaluating Differential Privacy Guarantees) provides the authoritative framework for DP evaluation. The SynQP framework (IEEE, 2025) introduces standardized privacy-quality evaluation matrices. Benchmarking DP tabular synthesis algorithms was a key topic at TPDP 2025, and federated DP approaches (FedDPSyn) are emerging for distributed generation.

2.4 Unwrap Audit & Robustness

Priority: Medium | Effort: Medium

2.5 Documentation: Operations

Priority: Medium | Effort: Low

Phase 3: Enterprise Grade (6-12 months)

Goal: Enterprise features, compliance certifications, and ecosystem maturity.

3.1 Multi-Tenancy & Access Control

Priority: High | Effort: High

3.2 Advanced Evaluation & Quality Gates

Priority: High | Effort: Medium

Quality Metrics to Implement:

• Statistical fidelity: Column distribution similarity (KL divergence, Wasserstein distance)
• Structural fidelity: Correlation matrix preservation, inter-table referential integrity
• Privacy: Nearest-neighbor distance ratio, attribute disclosure risk, identity disclosure risk (SynQP)
• Utility: Train-on-synthetic-test-on-real (TSTR) ML performance parity
• Temporal fidelity: Autocorrelation preservation, seasonal pattern retention
• Domain-specific: Benford compliance MAD, balance equation coherence, document chain integrity

3.3 Plugin & Extension SDK

Priority: Medium | Effort: High

3.4 Python Ecosystem Maturity

Priority: Medium | Effort: Medium

3.5 Regulatory Compliance Framework

Priority: Medium | Effort: Medium

Regulatory Context: The EU AI Act’s Article 50 transparency obligations (enforceable August 2026) require AI systems generating synthetic content to mark outputs as artificially generated in a machine-readable format. Article 10 mandates training data governance including documentation of data sources. Organizations face penalties up to €35M or 7% of global turnover for non-compliance. The NIST AI RMF 1.0 (expanded significantly through 2024-2025) provides the voluntary framework becoming the “operational layer” beneath regulatory compliance globally.

Phase 4: Market Leadership (12-18 months)

Goal: Cutting-edge capabilities informed by latest research, establishing DataSynth as the reference platform for financial synthetic data.

4.1 LLM-Augmented Generation

Priority: Medium | Effort: High

Research Context: Multiple 2025 papers demonstrate LLM-augmented tabular data generation. LLM-TabFlow (March 2025) addresses preserving inter-column logical relationships. StructSynth (August 2025) focuses on structure-aware synthesis in low-data regimes. LLM-TabLogic (August 2025) uses prompt-guided latent diffusion to maintain logical constraints. The CFA Institute’s July 2025 report on “Synthetic Data in Investment Management” validates the growing importance of synthetic data in financial applications.

4.2 Diffusion Model Integration

Priority: Medium | Effort: Very High

Research Context: The diffusion model landscape for tabular data has matured rapidly. TabDiff (ICLR 2025) introduced joint continuous-time diffusion with feature-wise learnable schedules, achieving 22.5% improvement over prior SOTA. FinDiff and its extensions (Imb-FinDiff for class imbalance, DP-Fed-FinDiff for federated privacy-preserving generation) are specifically designed for financial tabular data. A comprehensive survey (February 2025) catalogs 15+ diffusion models for tabular data. TabGraphSyn (December 2025) combines GNNs with diffusion for graph-guided tabular synthesis.

4.3 Advanced Privacy Techniques

Priority: Medium | Effort: High

Research Context: TPDP 2025 featured FedDPSyn for federated DP tabular synthesis and research on surrogate public data for DP (Hod et al.). The AI-generated synthetic tabular data market reached $1.36B in 2024 and is projected to reach $6.73B by 2029 (37.9% CAGR), driven by privacy regulation and AI training demand.

4.4 Ecosystem & Integration

Priority: Medium | Effort: Medium

4.5 Causal & Counterfactual Generation

Priority: Low | Effort: Very High

Industry & Research Context

Synthetic Data Market (2025-2026)

The synthetic data market is experiencing explosive growth:

• Gartner predicts 75% of businesses will use GenAI to create synthetic customer data by 2026, up from <5% in 2023.
• The AI-generated synthetic tabular data market reached $1.36B in 2024, projected to $6.73B by 2029 (37.9% CAGR).
• Synthetic data is predicted to account for >60% of all training data for GenAI models by 2030 (CFA Institute, July 2025).

Key Research Papers & Developments

Tabular Data Generation

• TabDiff (ICLR 2025) — Mixed-type diffusion with learnable feature-wise schedules; 22.5% improvement on correlation preservation
• LLM-TabFlow (March 2025) — Preserving inter-column logical relationships via LLM guidance
• StructSynth (August 2025) — Structure-aware LLM synthesis for low-data regimes
• LLM-TabLogic (August 2025) — Prompt-guided latent diffusion maintaining logical constraints
• TabGraphSyn (December 2025) — Graph-guided latent diffusion combining VAE+GNN with diffusion

Financial Domain

• FinDiff (ICAIF 2023) — Diffusion models for financial tabular data
• Imb-FinDiff (ICAIF 2024) — Conditional diffusion for class-imbalanced financial data
• DP-Fed-FinDiff — Federated DP diffusion for privacy-preserving financial synthesis
• CFA Institute Report (July 2025) — “Synthetic Data in Investment Management” validating FinDiff as SOTA

Privacy & Evaluation

• SynQP (IEEE, 2025) — Standardized quality-privacy evaluation framework for synthetic data
• NIST SP 800-226 — Guidelines for Evaluating Differential Privacy Guarantees
• TPDP 2025 — Benchmarking DP tabular synthesis; federated approaches; membership inference attacks
• Consensus Privacy Metrics (Pilgram et al., 2025) — Framework for standardized privacy evaluation

Surveys

• “Diffusion Models for Tabular Data” (February 2025) — Comprehensive survey cataloging 15+ models
• “Comprehensive Survey of Synthetic Tabular Data Generation” (Shi et al., 2025) — Broad overview of methods

Technology Trends Impacting DataSynth

Competitive Positioning

Market Landscape (2025-2026)

DataSynth Competitive Advantages

Competitive Gaps to Address

Regulatory Landscape

EU AI Act Timeline

Required Compliance Features

1. Synthetic content marking (Article 50): All generated data must include machine-readable markers indicating artificial generation
2. Training data documentation (Article 10): Generation manifests must document configs, sources, and processing steps
3. Quality management (Annex IV): Documented quality assurance processes for generation and evaluation
4. Risk assessment: Template for users to assess risks of using synthetic data in AI systems

Other Regulatory Frameworks

Risk Register

Technical Risks

Business Risks

Operational Risks

Success Criteria

Phase 1 Exit Criteria

• Docker image published and scannable (multi-stage distroless build)
• cargo-audit and cargo-deny passing in CI
• OTEL traces available via feature-gated otel flag with OTLP export
• Prometheus metrics scraped and graphed (Docker Compose stack)
• Code coverage measured and reported via cargo-llvm-cov + Codecov
• Cross-platform CI (Linux + macOS + Windows)

Phase 2 Exit Criteria

• Helm chart deployed to staging K8s cluster
• Generation manifest produced for every run (with per-file checksums, lineage graph, W3C PROV-JSON)
• Load test: k6 scripts for health, bulk generation, WebSocket, job queue, and soak testing
• Zero unwrap() calls in library crate non-test code (#![deny(clippy::unwrap_used)] enforced)
• Formal DP composition tracking with budget management (RDP, zCDP, privacy budget manager)
• Operations runbook reviewed and validated (deployment guides, runbook, capacity planning, DR, API reference, security hardening)

Phase 3 Exit Criteria

• JWT/OAuth2 authentication with RBAC
• Automated quality gates blocking below-threshold runs
• Plugin SDK documented with 2+ community plugins
• Python 1.0.0 on PyPI with async support
• EU AI Act Article 50 compliance verified
• SOC 2 Type II readiness assessment completed

Phase 4 Exit Criteria

• LLM-augmented generation available as opt-in feature
• Diffusion model backend demonstrated on financial dataset
• 3+ ecosystem integrations (Airflow, dbt, MLflow)
• Causal generation prototype validated

Appendix A: OpenTelemetry Integration Architecture

┌─────────────────────────────────────────────────────┐
│                   DataSynth Server                  │
│  ┌───────────┐  ┌──────────┐  ┌─────────────────┐  │
│  │  REST API  │  │   gRPC   │  │   WebSocket     │  │
│  └─────┬─────┘  └────┬─────┘  └───────┬─────────┘  │
│        │              │                │             │
│  ┌─────┴──────────────┴────────────────┴──────────┐ │
│  │          Tower Middleware Stack                 │ │
│  │  [Auth] [RateLimit] [Tracing] [Metrics]        │ │
│  └────────────────────┬───────────────────────────┘ │
│                       │                              │
│  ┌────────────────────┴───────────────────────────┐ │
│  │           OpenTelemetry SDK                    │ │
│  │  ┌─────────┐ ┌──────────┐ ┌─────────────────┐ │ │
│  │  │ Traces  │ │ Metrics  │ │     Logs        │ │ │
│  │  └────┬────┘ └────┬─────┘ └───────┬─────────┘ │ │
│  └───────┼───────────┼───────────────┼────────────┘ │
│          │           │               │               │
│  ┌───────┴───────────┴───────────────┴────────────┐ │
│  │           OTLP Exporter (gRPC/HTTP)            │ │
│  └────────────────────┬───────────────────────────┘ │
└───────────────────────┼─────────────────────────────┘
                        │
              ┌─────────┴──────────┐
              │   OTel Collector   │
              │  (Agent sidecar)   │
              └──┬──────┬──────┬───┘
                 │      │      │
           ┌─────┘  ┌───┘  ┌──┘
           ▼        ▼      ▼
       ┌──────┐ ┌──────┐ ┌─────┐
       │Jaeger│ │Prom. │ │Loki │
       │/Tempo│ │      │ │     │
       └──────┘ └──────┘ └─────┘

Appendix B: Recommended Rust Crate Additions

Appendix C: Key References

Standards & Guidelines

• NIST AI RMF 1.0 — AI Risk Management Framework
• NIST SP 800-226 — Guidelines for Evaluating Differential Privacy Guarantees
• EU AI Act (Regulation 2024/1689) — Articles 10, 50
• ISO/IEC 25020:2019 — Systems and software Quality Requirements and Evaluation (SQuaRE)

Research Papers

• Chen et al. (2025) — “Benchmarking Differentially Private Tabular Data Synthesis Algorithms” (TPDP 2025)
• SynQP (IEEE, 2025) — “A Framework and Metrics for Evaluating the Quality and Privacy Risk of Synthetic Data”
• Xu et al. (2025) — “TabDiff: a Mixed-type Diffusion Model for Tabular Data Generation” (ICLR 2025)
• Sattarov & Schreyer (2023) — “FinDiff: Diffusion Models for Financial Tabular Data Generation” (ICAIF 2023)
• Shi et al. (2025) — “Comprehensive Survey of Synthetic Tabular Data Generation”
• CFA Institute (July 2025) — “Synthetic Data in Investment Management”
• Pilgram et al. (2025) — “A Consensus Privacy Metrics Framework for Synthetic Data”

Industry Reports

• Gartner (2024) — “By 2026, 75% of businesses will use GenAI for synthetic customer data”
• GlobeNewsWire (January 2026) — AI-Generated Synthetic Tabular Dataset Market: $6.73B by 2029