Sensitive Data Scan
Know what sensitive data is in your files, and where.
A read-only sweep of your servers, shares and repositories for secrets, personal data and health data, sorted by a local model into a masked report and a fix plan.
What it is
Credentials, customer records and patient data end up in places nobody planned: old servers, file shares, repositories and forgotten database dumps. Most companies cannot say what is in those files, because they grew over years and across teams.
This scan answers that. It is worth running before anything that moves or opens up those files, such as a migration, an audit or an AI project, because whatever is in them goes along.
It runs on Scan PII, our own scanner, and detection is rule-based on purpose: the same files give the same result, every time. A model running where your data lives then decides which findings matter, and we turn them into a plan your team can act on.
How it works
01
It runs where your data lives
The scanner is a single read-only binary for Linux and macOS. It makes no network calls and changes nothing, so it can run on your own servers without your data going anywhere.
02
58 rules, grouped by what a match means
Rules cover API keys, passwords, private keys and database dumps, plus personal and health data such as card numbers, SSNs and medical record numbers.
03
Findings without the exposure
Every match is masked before it is shown or written to a report. You see where the value is, what kind it is and how serious it is, and never the value itself.
04
From thousands of matches to the few that matter
Rules cannot tell a test key from a live one. A local model reads each masked match with its file path and surrounding context, then decides whether it looks real, how exposed it is and what to do about it. It never sees the raw value, and it cannot remove a finding from the report.
05
Ranked, with what to do next
Findings are sorted by severity, and each rule carries advice, usually which credential to rotate. Your team starts with what matters most instead of a long flat list.
06
One report and one fix plan
We combine the results across your systems into one report and a prioritised plan: what to rotate, remove or keep out of scope. Whatever comes next starts from data you have actually looked at.
07
Keep it clean afterwards
The scanner outputs versioned JSON, so it can run in CI and fail a build when a high-risk finding appears. New exposure gets caught where it starts.
Who it’s for
Security and compliance
People who need evidence of where sensitive data sits, without handling it.
Data and platform teams
Engineers cleaning up old servers, shares and repositories before a migration.
Teams planning AI
Teams about to connect company data to AI who need to know what is in it first.
Growing companies
Organisations whose files grew faster than anyone’s view of what is in them.
Bring this to your organisation
Tell us which systems you are unsure about, and we will scope a scan around them.
The scan reads text files up to 20MB, so databases, cloud storage, PDFs and Office documents need to be exported or scoped separately. Personal data rules focus on common formats, including US identifiers, and regional formats may need adding. Detection is rule-based, so a clean result means no rule matched, not that the data is safe. The model’s decisions are recommendations for your team to review, and the scan does not replace a compliance assessment. About Scan PII
