NLP where language matters. Checksums where format defines truth.
Microsoft Presidio with spaCy NLP detects contextual entities — names, locations, medical terms. Purpose-built recognizer packs handle structured identifiers, validating checksums where the format defines one, so an Aadhaar number that fails Verhoeff never becomes a finding.
India pack
With format & checksum validators — coverage most Western DLP tools lack entirely.
Finance pack
Luhn and IBAN checksum validation cuts false positives at the source.
Healthcare pack
HIPAA-relevant entities recognized in code, documents, and scanned images.
Enterprise custom recognizers (recognizers/enterprise/) are a designed extension point. Biometric category: Coming Soon
Scan what your organization actually leaks.
Repositories
GitHub org, single repo, or explicit repo lists — the same scan orchestration as Secret Security, through the shared platform.
Documents
PDF — native-text, scanned, or mixed, classified page by page — DOCX including table cells, plus TXT, MD, CSV, JSON, and XML.
Images
PNG, JPEG, and TIFF through Tesseract OCR — with per-finding bounding boxes persisted, so you can see exactly where the data sits.
Every finding tagged with the regulations it implicates.
A finding can carry multiple regulation tags. Per-regulation dashboards show violation counts by repository and file, with CSV, TXT, and JSON exports as evidence. The compliance mapper is a per-regulation plugin — CCPA, LGPD, and POPIA are on the roadmap.
GDPR
EU personal-data protection — names, emails, locations, identifiers.
HIPAA
US health information — MRNs, diagnoses, prescriptions, insurance IDs.
PCI DSS
Payment card data — Luhn-validated card numbers, CVV, expiry dates.
DPDP
India's data protection act — Aadhaar, PAN, GSTIN, UPI, IFSC, and more.
Masked before it ever touches disk.
Policy-driven transforms — mask, redact, or anonymize — plus a 0–100 risk score are applied before persistence. Classification is deterministic, so findings are fully processed in one pass; there is deliberately no validation stage.
- ✓Encrypted-at-rest storage under the shared platform crypto engine
- ✓Raw values never appear in list APIs
- ✓Risk scoring from category, sensitivity, compliance, and confidence
An audit story you can defend.
Written reason required — no justification, no reveal.
Rate limit checked — sliding-window limits per key.
Decrypted in memory — never re-serialized to disk.
Audit log written — who, when, why. Immutable.
Value discarded — the reveal is a moment, not a state.
Prove your compliance posture from real scans.
Nine dashboard pages, per-regulation views, and exportable evidence — self-hosted.
Part of the Perryscope platform — see also Secret Security and AI Guardienne, or explore the architecture.