Privacy scanning
Privacy Security detects regulated personal data in repositories, uploaded documents, and images — classifies it, maps it to regulations, and masks it before persistence. Classification is deterministic, so there is no validation stage.
Detection
- Microsoft Presidio with spaCy
en_core_web_lg— names, emails, phones, locations, IPs, SSNs, passports, IBANs, credit cards - India pack — Aadhaar (Verhoeff), PAN, GSTIN, UPI, IFSC, passport, driving license, voter ID
- Finance pack — SWIFT/BIC, routing numbers, CVV, expiry dates
- Healthcare pack — patient name, MRN, insurance ID, physician, hospital, diagnosis, prescription
Sources
| Repositories | GitHub org / repo / repo list, through the shared scan orchestration |
| Documents | PDF (native, scanned, or mixed — classified page by page), DOCX incl. tables, TXT / MD / CSV / JSON / XML |
| Images | PNG / JPEG / TIFF via Tesseract OCR, bounding boxes persisted per finding |
Classification & compliance
Every entity is classified PII · PHI · PCI · Financial with a sensitivity level (table-driven EntityClassifier), then tagged with the regulations it implicates — GDPR, HIPAA, PCI DSS, DPDP. A finding can carry multiple tags. Biometric is a reserved category Coming Soon.
Masking & risk
Policy-driven transforms — mask, redact, or anonymize — and a 0–100 risk score (category + sensitivity + compliance + confidence) are applied before anything is written. Storage is encrypted at rest via the shared platform crypto engine; raw values never appear in list APIs; the reveal flow requires a written reason and is rate-limited and audited.
Dashboards & exports
Nine dashboard pages, including a per-regulation Compliance Dashboard and a live API-reference page driven by GET /privacy/metadata. Evidence exports in CSV, TXT, and JSON.
Source: products/privacy_security/ · recognizers/{india,finance,healthcare}/ · PRODUCT_ANALYSIS §5.2