Sensitive Data Discovery

Classification Across Databases, Files, and Storage

Find regulated and business-sensitive data across databases, files, storage, and collaboration platforms with classification, OCR, and scheduled scans.

Book a Demo Explore Integrations

Database and Content Scanning
Information Types and OCR
Searchable Findings

Product overview

What this product covers

Sensitive Data Discovery turns scattered records and content into an inventory that teams can search, review, and report on.

Scheduled tasks inspect database metadata and selected values or extract content from files and objects. Information Types use patterns, dictionaries, context checks, NLP, ML/ONNX scoring, and OCR to classify each match.

Every finding points to the exact database object or content path and records how the match was classified.

Discovery workflow

Run a Repeatable Discovery Workflow

Move from a connected database or content repository to reusable findings in four clear steps.

Connect and set the scope

Add credentials, verify access, and choose the databases, schemas, paths, buckets, shares, files, or other content to inspect.
Configure classification

Choose Information Types, security standards, custom definitions, OCR, and extraction options.
Run and review

Start the task manually or on a schedule, then review matched locations, classifications, statistics, and processing errors.
Report and reuse

Export CSV or PDF reports and add selected findings to Object Groups for later security policies.

Each run keeps its scope, configuration, and results together, so teams can compare scans over time.

Product evidence

See the workflow in DataSunrise

Product screens show how policy, evidence, and protection appear in practice.

DataSunrise Periodic Data Discovery task named Customer Privacy Inventory - GDPR, connected to Customer360 PostgreSQL, saving findings to the Compliance_GDPR_objects Object Group with additional metrics enabled — **Configure a repeatable discovery task** Periodic Data Discovery ties a named privacy inventory to its source, result Object Group, sampling strategy, match threshold, and optional metrics. This example prepares a GDPR-oriented scan of the Customer360 PostgreSQL instance.

DataSunrise Information Type editor testing a custom email regular expression against a PostgreSQL column value, with one matched row and a 100 percent match result — **Test a custom Information Type** The Information Type editor lets a team define and validate classification logic before using it in discovery. Here, a custom email pattern is tested against a PostgreSQL value and returns one match.

DataSunrise Periodic Data Discovery results for Customer Privacy Inventory - GDPR showing Success with findings, scanned database objects, and nine detected Information Types — **Review scan status and statistics** The completed task records its source, database, schema, execution time, and status. Result charts summarize scanned databases, schemas, tables, columns, and the nine Information Types detected in this run.

DataSunrise discovery results showing the customers credit_card_num column classified as Credit Card and associated with GDPR, PCI DSS, SOX, ISO 27001, CCPA, and other security standards — **Trace a classification to the exact column** Search Results connect a detected Information Type to its database, schema, table, and column. This example identifies customers.credit_card_num as Credit Card data and displays the associated security-standard mappings.

1 / 4

Discovery details

Explore Sensitive Data Discovery

1 / 4

Inspect Sensitive Data Across Your Environment

Source	What DataSunrise inspects	How it connects
Databases and analytics	Schemas, tables, columns, metadata, and selected value samples	Database connection and Periodic Data Discovery task
Object and cloud storage	Objects, files, documents, images, and archives in Amazon S3, Azure storage, and Google Cloud Storage	Storage connector
Local and network storage	Files reached through local paths, SMB2/3, FTP/FTPS, or NFS	File-storage connector and discovery worker
Microsoft OneDrive and SharePoint	Files, document libraries, metadata, and extracted content	Microsoft 365 authentication and Cloud File Discovery

Classify With Layered Detection Methods

Information Types define what DataSunrise should find and how it should validate a match. Teams can use built-in security standards or create definitions for their own identifiers.

Detection method	How it helps
Patterns and regular expressions	Find structured account, identity, contact, and payment values
Names, metadata, and data types	Use column, field, file, or object context to narrow matches
Dictionaries and lexicons	Match approved value sets, terms, and language-specific vocabularies
NLP and context validation	Evaluate surrounding content and proximity or semantic conditions
Lua validation	Apply custom validation logic
ML/ONNX-assisted scoring	Add AI Score evidence to selected classification workflows
OCR	Extract text from images, image-based PDFs, and embedded document images

Control Scan Depth and Execution

Database tasks can use top, random, all-row, incremental, and randomized strategies. File and object tasks can process complete content or a configured byte range, apply source tags and path filters, and distribute work across multiple DataSunrise servers.

Amazon S3 also offers S3 Inventory mode for manifest-driven discovery.

Teams can start with a narrow sample for a fast inventory, then increase scan depth for broader coverage. Processing reports make encrypted, damaged, inaccessible, and unreadable content visible for follow-up.

Turn Findings Into Security Work

Discovery gives teams a concrete starting point for cleanup, compliance evidence, and protection. Instead of reviewing entire systems by hand, they can focus on the database objects and content paths where sensitive information was found.

Object Groups let teams reuse a selected set of findings in audit, masking, firewall, or test-data work. Teams choose and configure the policy that fits the data.

File and Object Storage Discovery explains file formats and connectors. Active DSPM adds cloud inventory and posture. Data Protection and Enforcement covers controls for live traffic and protected copies.

FAQ

Frequently Asked Questions

Does discovery change source data?

No. Discovery reads metadata or content and records findings. Static Data Masking creates a separate de-identified target.

How do teams turn a discovery result into protection?

Findings can populate Object Groups and give teams the exact data context needed to configure masking, audit, or firewall policies.

Can DataSunrise inspect images and image-based documents?

Yes. DataSunrise combines native OCR with Amazon Textract for S3 to inspect images, image-based PDFs, and embedded document images.

How does DataSunrise scan different data environments?

Databases use sampling, storage uses connectors and file extraction, and images use OCR. The results arrive in the same discovery workflow.

Map the right workflow

See how DataSunrise works with your technology stack

View Integration Examples