Abstract: Protected data type classes are provided for performing operations on protected data types. A fact manifest is generated for a software package that utilizes the classes at build time. The fact manifest describes the protected data types used by the software package. The fact manifest can be used to deploy the software package only to hosts that are authorized to handle the specified protected data types. The fact manifest can also be utilized to create a protected data type usage graph that identifies the hosts that handle protected data, the type of protected data handled, and the network connections between the hosts. The protected data type classes can also generate data at runtime identifying the runtime usage of protected data. The protected data type usage graph can also specify the runtime usage of protected data by the hosts.