IPIgnitePII
Talk to us Request a demo
PII discovery · On-prem · Air-gapped

Know what personal data you hold. Prove it. Without it ever leaving your network.

IgnitePII finds personal data across cloud, SaaS, databases, file shares and endpoints, classifies it against the privacy law that applies to you, and produces audit-ready evidence. Delivered as a sealed appliance that runs with zero internet.

Request a demo See how it works
111 detectors 34 countries & regions 17 connectors 11 compliance packs 0 internet required
Built forBankingInsuranceHealthcareGovernmentDefenceManaged security partners
17 connectors, plus endpoint agents for laptops and servers
AWS S3 / RDSAzure BlobGoogle CloudPostgreSQLMySQL / MariaDBMicrosoft SQL ServerOracleMongoDBAzure Cosmos DBAWS DynamoDBGoogle FirestoreMicrosoft 365Google WorkspaceSalesforceServiceNowSlackFile shares / SMBWindows · Linux · macOS agents
Why IgnitePII

Five reasons it works where other scanners don't

IgnitePII is a sealed appliance that locates personal data everywhere it hides, verifies every match, and produces evidence that stands up to an audit, all without the data ever leaving your network.

01 / 05 · Locate

Locate first. Everywhere data can live.

Agents on endpoints, agentless connectors into cloud, SaaS and databases. One inventory, built before a single byte of content is read.

17connectors3agent platforms1control plane
  • EndpointsWindows, Linux, macOS agents that auto-enrol over mutual TLS. Intel and ARM.
  • CloudAWS, Azure, Google Cloud, Cosmos DB, DynamoDB, Firestore, plus SMB shares and CIDR discovery.
  • SaaSMicrosoft 365, Google Workspace, Salesforce, ServiceNow, Slack, where PII actually accumulates.
inventorydiscovery run · 14 sources
\\fs01\finance · 48,210 filesreachable
postgres://claims · 212 tablesreachable
m365://sharepoint/hr · 3,904 itemsreachable
lap-0412 (macOS, ARM) · agent 2026.10enrolled
02 / 05 · Verify

Verified matches, not pattern guesses.

Where an identifier has a published check digit, the match is arithmetically confirmed. A 16-digit order number is never reported as a card.

44verified detectors31algorithms111detectors total
  • ChecksumLuhn, Verhoeff, mod-97, mod-11 for cards, Aadhaar, IBAN, NHS, CPF, DNI, PESEL, BSN, My Number, NRIC and more.
  • ContextKeyword windows corroborate weak detectors; low-confidence candidates are dropped, not stored.
  • CardsOne finding per card with scheme and BIN: Visa, Mastercard, Amex, RuPay, UnionPay, JCB, Diners.
validationrefunds-q3.xlsx · hidden sheet
4532 0151 1283 0366Luhn ✓ · Visa · critical
2345 6789 0123Verhoeff ✓ · Aadhaar
4000 0000 0000 0001Luhn ✗ · dropped
ORD-1234567890123456no checksum · dropped
03 / 05 · Air-gap

Runs where the internet doesn't.

The appliance ships with its entire software closure. No outbound dependency at install or at run time, including OCR.

0internet callsOCRenabled, offline25+file formats
  • FormVMware OVA or bootable ISO. Live-boot for a zero-trace evaluation, or install to disk.
  • OCROCR enabled, fully offline: scanned passports, photographed ID cards and claim forms are read locally.
  • UpdatesOffline update path with Ed25519-signed bundles for disconnected and regulated sites.
egressappliance · last 24h
outbound connections0
OCR · scan_0412.jpg (HEIC → text)local · 1.9s
rulepack builtin v2026.10.2signature ✓
licence · air-gapped activationvalid
04 / 05 · Minimise

Finds the data without copying it.

Raw matched values are never persisted. A finding keeps the detector, severity, confidence, location and a masked, format-preserving preview.

0raw values stored≤4characters revealedoffcontent egress by default
  • MaskingIdentical on agent and appliance, revealing at most the last four characters and never more than half.
  • GatesOCR upload and validation samples default off, admin-only to change, and recorded in the audit trail.
  • No AI egressNo external model or API receives content. The vendor never sees customer findings.
findingwhat is actually written
detector · credit_card · critical · 0.98stored
sample_preview•••• •••• •••• 9057
matched_text"" (empty)
email previewv•••@•••.com
05 / 05 · Prove

Evidence that survives an audit.

Reports state the scope that produced them. Ledgers are hash-chained and append-only, so even an administrator cannot quietly alter the record.

11compliance packs34regions4tamper-evident ledgers
  • ScopeGDPR, HIPAA, PCI-DSS, CCPA, DPDP, PDPA, GCC packs decide which identifiers, regions and categories apply.
  • LedgerHash-chained audit, enrolment, inventory and discovery ledgers with verify and reconcile endpoints.
  • ExportPDF reports, SIEM over syslog or webhook in CEF or JSON, email through your own smart host.
audit ledgerchain verify · 18,402 entries
a91f…c3 → 7d02…e8 · admin · policy.allow_samples=false✓
7d02…e8 → 44b1…0a · operator · finding 2219 false-positive✓
44b1…0a → 9e7c…51 · system · report PDF · scope GDPR+PCI✓
Product

Discover. Detect. Remediate. Prove it.

One console, one appliance, one lightweight agent. Every module below is a shipped capability of the current release.

Enumerate every place data can live

Connect a source, run discovery, and the inventory fills with every store before you scan a byte. Scope is always explicit: only sources an administrator registers are ever touched.

  • Connectors for AWS, Azure, Google Cloud, five relational and NoSQL databases, three cloud-native NoSQL stores, and Microsoft 365, Google Workspace, Salesforce, ServiceNow and Slack. Guided setup with a live test-connection for each.
  • Endpoint agents for Windows, Linux and macOS (Intel and ARM) that auto-enrol on first boot over mutual TLS.
  • Network discovery over operator-specified CIDR ranges, plus SMB file servers on Windows, NAS and macOS.
  • Metadata-first enumeration you can run on its own, reserving content scanning for the repositories that justify it.
Windows · macOS · Linux agents
SMB file shares
Network discovery (CIDR)
Appliancecontrol plane · detection engine · findings store
AWS · Azure · GCP
PostgreSQL · MySQL · SQL Server · Oracle · MongoDB
M365 · Workspace · Salesforce · ServiceNow · Slack

Identify real PII with validated detectors

111 detectors across eight categories, each with a severity, a confidence score, keyword context windows and a region. The agent runs the same set as the appliance, so a laptop scan and a file-share scan find the same things.

  • Checksum validation on 44 detectors: Luhn for cards, Verhoeff for Aadhaar, ISO 7064 mod-97 for IBAN, NHS mod-11, CPF, DNI, codice fiscale, PESEL, BSN, My Number, NRIC and more.
  • Card intelligence: one consolidated finding per card with scheme and BIN for Visa, Mastercard, Amex, Discover, Diners, JCB, RuPay, UnionPay and others.
  • OCR enabled, fully offline, so a passport photographed into a shared folder or a scanned claim form is not invisible. OCR output is repaired before matching.
  • Reads values the way people write them: hyphenated or not, dates in any format, labels with or without accents. Add your own regex detectors alongside the built-in pack.
4532 0151 1283 0366Luhn ✓ · Visa · critical
2345 6789 0123Verhoeff ✓ · Aadhaar
GB82 WEST 1234 5698 7654 32mod-97 ✓ · IBAN
4000 0000 0000 0001Luhn ✗ · dropped
ORD-1234567890123456no checksum · dropped

Triage findings and produce evidence that stands up

Findings hold the detector, type, severity, confidence, location and a masked preview. Reports state the scope that produced them: which categories, regions and compliance packs were in force.

  • Findings workbench with bulk sort and select, true or false positive marking, masked previews and the exact source location.
  • Audit-ready PDF reports with scope provenance, for auditors and stakeholders.
  • SIEM export of the audit trail to Splunk, QRadar and others over syslog or webhook in CEF or JSON.
  • Notifications by email through Microsoft 365, Google Workspace or any SMTP smart host, with per-event toggles.
IgnitePII-report-2026-10.pdfscope v2026.10.2
GDPRPCI-DSSIndia DPDPEU · UK · INCards · Gov ID · Health
Critical findings, 14 sources128
Marked false positive by operator11
Forwarded to SIEM (CEF)live

Run it unattended, govern it tightly

Scan profiles decide what to look for. Schedules run them on a cadence. The licence scopes categories, regions, packs and seats, and everything an administrator does lands in a tamper-evident audit ledger.

  • Scan profiles and schedules for recurring, incremental scans that skip unchanged files.
  • Agents fleet view: enrolment, status and deployment, including Windows MSI through Active Directory Group Policy.
  • Users, roles and MFA with admin, operator and viewer tiers, TOTP and optional LDAP.
  • Licence, certificate and settings: hot-applied signed licences, bring your own CA for the console, and in-product help.
Dashboard · Connectors · Discovery · Inventoryposture
Scan Profiles · Schedules · Findings · Reportsscan
Detection Rules · Agentstune & fleet
Users · Audit · License · Certificategovern
111built-in detectors, identical on appliance and agent
34countries and regions with local identifiers
31check-digit algorithms verifying 44 detectors
25+file formats read, including scans and photos
0internet connections required
Detection coverage

Eight categories, severity-rated out of the box

32 critical, 33 high, 25 medium and 21 low. Remediation can be prioritised rather than triaged by hand.

Government ID
41
General PII
33
Financial
9
Tax identifiers
9
Payment cards
7
Health data
7
Network IDs
3
Credentials
2
32 critical33 high25 medium21 low

Verified, not pattern-matched

Where an identifier has a published check digit, the match is arithmetically confirmed: cards (Luhn), Aadhaar (Verhoeff), IBAN (mod-97), UK NHS, Brazil CPF/CNPJ, Spain DNI/NIE, Italy codice fiscale, France INSEE, Germany tax ID, China resident ID, Korea RRN, Japan My Number, Singapore NRIC, Australia TFN/ABN/Medicare, Poland PESEL, Netherlands BSN, Swiss AHV.

Reads values the way people write them

123-45-6789 and 123456789. 12/05/1990 and 12 May 1990. +1 (415) 555-2671 and 98765 43210. Labels with or without accents, such as Téléphone.

Finds data in images and scans

OCR enabled and fully offline, with no cloud calls. Words the recogniser ran together and digits misread as letters are repaired before matching.

Geographic coverage · 34 regions

Country-specific identifiers, not just email and credit card

India DPDP

Aadhaar, PAN, GSTIN, voter ID (EPIC), passport, driving licence, vehicle registration, IFSC, PIN code, mobile.

United States HIPAA · CCPA

SSN, ITIN, EIN, Medicare MBI, ZIP, MRN, ICD-10, NDC, phone.

United Kingdom UK GDPR

National Insurance number, NHS number, UTR, passport, postcode, phone.

European Union GDPR

Germany tax ID, ID card, IBAN, PLZ; France INSEE; Spain DNI / NIE; Italy codice fiscale; Netherlands BSN; Poland PESEL; Sweden personnummer; Portugal NIF; Ireland PPS; Belgium national register; Denmark CPR.

Gulf GCC bundle

Emirates ID (UAE), Saudi national ID, Qatar QID, Bahrain CPR.

Asia-Pacific PDPA and more

Japan My Number, Singapore NRIC, South Korea RRN, China resident ID, Indonesia NIK, Australia TFN / Medicare / ABN / passport, New Zealand IRD.

Americas

Canada SIN, postal code, passport; Brazil CPF / CNPJ / voter ID / CEP; Mexico CURP / RFC; Argentina DNI.

Rest of Europe & Africa

Switzerland AHV, Turkey TC Kimlik, Russia INN / SNILS, South Africa ID.

Global

Payment cards (Visa, Mastercard, Amex, Discover, Diners, JCB), IBAN / BIC-SWIFT, email, phone, IPv4 / IPv6, MAC, JWT, AWS access keys, dates of birth, passports.

Compliance mapping · 11 packs

Scope a scan by the regulation that applies

Pick the pack and the right identifiers, regions and categories follow. Nobody has to know which law covers which identifier.

GDPR EUHIPAA US healthcarePCI-DSS payment cardsCCPA CaliforniaIndia DPDPSingapore PDPAUAE PDPLSaudi PDPLQatar DPLBahrain PDPLGCC Bundle Gulf states in one

Compliance packs scope a scan and are mapped to each regulation's identifier set. They are not a legal certification of compliance.

File formats · 25+

It reads where personal data actually hides

DocumentsPDF (text, scanned, copy-protected), DOCX with headers, footers, text boxes and pasted images, legacy DOC, RTF, ODT
SpreadsheetsXLSX including hidden sheets with each value kept against its column heading, XLS, ODS, CSV, TSV
PresentationsPPTX with speaker notes and tables, PPT, ODP
ImagesPNG, JPEG, TIFF, BMP, GIF, WebP, iPhone HEIC, via OCR
EmailEML, MBOX, Outlook MSG, with attachments opened and scanned
ArchivesZIP, TAR, GZ, 7z, opened recursively
TextAny text, log, JSON, XML, YAML or SQL file in UTF-8, UTF-16 or legacy Windows encodings
Deployment

From import to first report in five steps

A product you run, not a SaaS you ship data to. That single fact wins regulated and air-gapped deals.

Import the appliance

Deploy the OVA on VMware or VirtualBox, or boot the ISO on bare metal. The image carries its entire software closure.

Apply your licence

Signed entitlements set categories, regions, packs and seats. Online or air-gapped activation, hot-applied with no restart.

Connect sources

Add cloud, SaaS and database connectors with a live test-connection. Roll agents out by MSI and Group Policy; they auto-enrol.

Scan on a schedule

Choose a scan profile or a compliance pack, set a cadence, and let incremental scans run unattended.

Triage and report

Work the findings, mark false positives, export to your SIEM, and hand the auditor a PDF that states its own scope.

Virtual appliance (OVA)Standard VMware / ESXi deployment on Rocky Linux 9.
Bootable ISOBare metal or a zero-trace evaluation. Live-boots and installs; USB persistence supported.
Endpoint agentWindows .exe or MSI, macOS .dmg, Linux AppImage. Intel and ARM.
Fleet rolloutWindows MSI through Active Directory Group Policy.
Air-gappedNo internet at install or at run time. Offline update path for disconnected sites.

Ready to see it on your own data?

Boot the ISO on a spare machine, point it at one file share, and read the first findings before lunch. Nothing leaves the box.

Request a demo Deployment options
Security & governance

Built for trust. Tamper‑evident by design.

The product holds itself to the same bar it holds your data to. Even an administrator cannot quietly alter the evidence.

Raw values never stored

A finding keeps the detector, type, severity, confidence, path, offsets and a masked preview. The matched value is written as empty.

•••• •••• •••• 9057 · v•••@•••.com

Mutual TLS, pinned agents

Enrolment pins the appliance certificate fingerprint; every message after that is mutually authenticated and signed, with replay protection.

Hash-chained audit ledgers

Append-only ledgers for admin actions, enrolment, inventory and discovery. Verify and reconcile endpoints detect any out-of-band edit.

MFA, RBAC and rate limits

TOTP multi-factor, login CAPTCHA, bcrypt hashing, optional LDAP, admin / operator / viewer roles and per-IP rate limiting.

Encrypted secrets, fail-closed

AES-GCM encryption at rest for every stored credential. The appliance refuses to start if encrypted records exist and the key is absent.

Signed supply chain

Ed25519 signatures and SHA-256 verification on agent updates, rule packs and licences. Content-egress paths for OCR and validation samples default to off.

About us

IgnitePII is built by Zerodayops

We build data-sovereign security software for organisations that cannot, or will not, ship their most sensitive data to someone else's cloud: banks, insurers, healthcare providers, government bodies and the partners that serve them.

IgnitePII started from a simple observation. Most teams genuinely do not know where their personal data is, and the tools that promise to tell them are noisy, cloud-dependent, or cannot be deployed in regulated and disconnected networks at all. We set out to build a scanner you could run anywhere, trust completely, and hand to an auditor.

Every claim on this page maps to a shipped capability, read from the product's own rulepack, connector registry and appliance source. We keep it that way.

Work with us
01
Locate before you protectDiscovery comes first. Policy, DLP and remediation only work once you know what you hold.
02
Your data stays yoursNo vendor-hosted processing. No external AI or ML service receives content. The vendor never sees customer findings.
03
Accuracy drives adoptionChecksum validation and context corroboration cut the alert fatigue that kills most scanner rollouts.
04
Evidence must stand upReports state their scope. Ledgers are hash-chained. The product is designed to survive an audit, not just pass a demo.
FAQ

Questions buyers ask first

Does any of my data leave my network?

No. Detection, OCR and classification run on the endpoint agent or the appliance inside your trust boundary. There is no vendor-hosted processing, no external AI or ML API, and the appliance runs with zero internet access if you want it to. The only outbound paths are the ones you configure, such as SIEM forwarding or email notifications.

Does IgnitePII store the personal data it finds?

No. A finding records the detector, severity, confidence, location and a masked preview such as •••• •••• •••• 9057. The raw matched value is written as empty. Uploading images for appliance-side OCR and uploading validation samples are both off by default and need an audited administrator opt-in.

Is this a compliance certification?

No. The 11 compliance packs scope a scan to the identifiers, regions and categories each regulation cares about, and reports state the scope that produced them. They support your GDPR, HIPAA, PCI-DSS, DPDP or PDPA programme; they do not certify it.

How accurate is detection?

44 of the 111 detectors are arithmetically verified using 31 check-digit algorithms, including Luhn, Verhoeff, mod-97 and mod-11. Weak detectors need keyword corroboration and low-confidence candidates are dropped rather than stored. Operators can also mark false positives in the findings workbench.

What do I need to run a pilot?

A VMware or VirtualBox host for the OVA, or any machine that can boot the ISO, plus one source to point it at: a file share, a database, a cloud bucket or a handful of endpoints. Agents install from native packages and auto-enrol. Most pilots produce their first report in the first session.

How is it licensed?

By signed entitlement: capability categories, regions, compliance packs and agent seats. Activation works online or fully air-gapped, seats free automatically when endpoints retire, and upgrades are a new signed licence applied without a restart. Pricing is scoped per engagement; ask us in the form below.

Get started

See your own PII surfaced in 30 minutes

Tell us a little about your environment and we will set up a technical demo on your data or our sandbox, then scope a pilot on one segment: a database, a file share or a set of endpoints.

  • 30-minute technical demo
  • Scoped pilot on one real source
  • Air-gapped evaluation via bootable ISO, leaving no trace
Zerodayopshello@zerodayops.com
Where does your data live? (pick any)