Find your sensitive data,
before someone else does.
EIR discovers and classifies sensitive data across your SaaS apps, cloud accounts, databases, code and file servers, tells you which regulator to notify when it matters, and puts an analyst on every critical finding.
Your sensitive data is not where you think it is.
Passwords get pasted into ticket comments. Government IDs end up in undocumented CRM fields. Health records sit in support attachments. Storage buckets go public without anyone noticing, and spreadsheets of personal data sit on file servers nobody has audited in years. Traditional DLP watches network traffic and email. It cannot read comment history, walk a CRM schema or scan every object in every cloud account.
EIR connects read-only to the places sensitive data hides, maps what is there, classifies it by type and sensitivity, and keeps watching as it changes. Content is classified inside your environment; only finding metadata (data type, sensitivity, location) comes back to us. When a finding is reportable, EIR shows the regulator, the deadline and the forms. When it is critical, it opens a case in MSOC and an analyst starts on it.
- An inventory of your data estate: schemas, buckets, SaaS objects and custom fields, before classification starts
- Every finding with data type, sensitivity level, confidence, location and remediation steps
- Regulatory guidance per reportable finding: the right regulator, the deadline, pre-filled forms and draft notification letters
- Continuous re-classification of new and changed records, files and messages
- Automatic escalation of critical findings to MSOC for live analyst response
- An exportable compliance package for your auditors
Six stages, from inventory to audit.
Discover
EIR maps every connected source without reading content, usually in one to two hours, and gives you a data estate dashboard before classification begins.
Prioritize
Sources are ranked by risk first. Sensitive-sounding field names, personal-data patterns and access anomalies are scanned ahead of the rest, so 85 to 90 percent of findings surface within the first eight hours.
Classify
Over 2 to 72 hours, depending on volume, more than 500 detection patterns run offline alongside AI-assisted classification for ambiguous cases. Air-gapped deployment is available for classified environments.
Alert and respond
Findings appear with type, sensitivity, confidence, location and remediation steps. Critical findings escalate to MSOC for managed clients.
Report and comply
Each reportable finding shows the regulatory chain: regulator, deadline, pre-filled breach forms and draft notification letters.
Watch for change
After the baseline, new or modified records, files and messages are re-classified within minutes, not on the next scheduled scan.
Every place sensitive datatends to hide.
Every connection is read-only. Custom connectors can be built for legacy ERPs, proprietary databases and sector-specific platforms.
| Source type | Examples | What EIR reads |
|---|---|---|
| CRM and customer platforms | Salesforce, HubSpot, Dynamics 365, Zendesk, ServiceNow | Standard and custom objects, custom fields, notes, tickets and attachments |
| Project and collaboration | Jira, Confluence, Asana, Monday.com, Linear, Notion, Slack (beta) | Issues, pages, comments, attachments and version history, so edited-out data is still found |
| Microsoft 365 and Google Workspace | SharePoint, OneDrive, Exchange Online, Teams, Gmail, Drive | Documents, version history, mailboxes, chats and attachments |
| Cloud platforms | AWS, Microsoft Azure, Google Cloud, Oracle Cloud | Object storage, managed databases and warehouses, with change detection |
| Databases and warehouses | PostgreSQL, SQL Server, Oracle, MongoDB, Snowflake, BigQuery, Databricks | Column names checked first, then sampled rows; Parquet, Avro, ORC and Delta Lake files |
| File systems and storage | Windows shares, NFS, NAS, Dropbox, Box, Egnyte | File content and metadata |
| Code repositories | GitHub, GitLab, Bitbucket, Azure DevOps | Repos, issues, pull requests and wikis, with secret scanning for committed keys and tokens |
| Email archives | Exchange on-premises, PST, MBOX and EML files, archive platforms | Mailboxes and attachments over configurable date ranges |
Eight categories ofsensitive data.
Identity
SSNs, passports, driver's licences, national IDs and date-of-birth combinations, with national ID formats for 40+ countries.
Financial
Card numbers, IBANs, SWIFT codes, bank accounts, routing numbers and tax IDs.
Health
Health card numbers, medical records, diagnosis codes, prescriptions and insurance IDs.
Secrets
API keys, tokens, private keys, connection strings and environment files.
Contact and personal
Names with contact details, emails, phone numbers, addresses and IPs tied to individuals.
Corporate sensitive
Financial projections, M&A materials, intellectual property, personnel records and legal correspondence.
Network
Internal hostnames, VPN credentials, firewall configurations and infrastructure-as-code with embedded secrets.
Regulated data
Structured personal data matched against the frameworks that apply to you.
Five levels,mapped to your policy.
Levels are configurable and can be mapped to the data classification policy you already have.
| Level | Meaning | Default response |
|---|---|---|
| Public | Approved for external distribution | No action required |
| Internal | Internal use only, no regulatory obligation | Periodic review |
| Confidential | Business sensitive, limited distribution | Access review and DLP policy update |
| Restricted | Regulatory or legal sensitivity: personal, health and payment data, credentials | Remediation required |
| Secret | Highest sensitivity: government IDs, cryptographic keys, M&A material | Immediate response |
Who to tell,by when.
For each reportable finding EIR identifies the jurisdiction, the regulator and the deadline, with pre-filled forms. Guidance is reviewed quarterly. It speeds up your response; it is not legal advice, and final notification decisions sit with your counsel.
| Framework | Applies to | What EIR provides |
|---|---|---|
| Personal data protection laws (UAE PDPL, DIFC and ADGM, Saudi PDPL, Singapore PDPA and others) | Organizations processing personal data across the GCC and Asia | Jurisdiction, regulator, deadline, pre-filled forms and draft notification letters |
| PCI DSS v4.0.1 | Anyone storing or processing cardholder data | Acquiring-bank and card-brand notification steps and forms |
| GDPR and HIPAA | EU and US data subjects | The right supervisory authority and deadline tracking |
| SOX, NIST CSF 2.0, ISO/IEC 27001, CIS Controls v8 | Regulated and audited organizations | Findings mapped for audit and GRC reporting through Forseti |
Inside your boundary,with a SOC behind it.
Data residency by design
Classification happens inside your boundary and only finding metadata leaves it, and EIR is deployed to meet your data-residency requirements. That matters to organizations regulated under the UAE PDPL, the Saudi PDPL, the CBUAE or SAMA.
Findings to an analyst, one contract
When EIR finds a critical exposure it opens an incident in MSOC, staffed by our analysts, and remediation guidance follows. For managed clients there is no gap between the alert and the response.
Built for investigations
After a breach, EIR tells our forensics team and your counsel what sensitive data the affected systems held, which drives scoping and notification.
Who it is for
Organizations holding personal, health or payment data across many systems, who need to know where it actually sits, prove it to an auditor, and have someone act when a critical exposure turns up. Classification levels map to your existing data classification policy.
- Data loss prevention, policies and enforcement for data in motion
- MSOC, live analyst response to critical findings
- GRC & compliance, Forseti turns findings into compliance reporting
- HILDR, track sensitive files once they leave
What buyers ask.
Why is EIR under incident response and forensics?
Because the first question after a breach is what data was exposed. EIR scans the affected systems and tells you what sensitive data they held and which regulator to notify, and our forensics team uses it inside investigations. You can also run it before anything happens.
Does EIR read our raw data?
Content is classified inside your environment and discarded. Only finding metadata, the data type, sensitivity and location, comes back to us, never the raw data.
Where does our data stay?
We deploy to meet each client's data-residency requirements, including in-country where regulation requires it. Classification runs inside your environment and only finding metadata leaves it.
What happens when a critical finding turns up?
You get an alert with remediation steps and regulatory guidance. Managed clients also get automatic escalation to MSOC, where an analyst starts the response.
We already have DLP.
DLP watches traffic and email in motion. EIR finds what is already sitting in ticket comments, CRM fields, cloud buckets and old file shares, which is where most exposure lives.
Do you support air-gapped or classified environments?
Yes. EIR can run fully offline, and air-gapped deployment is available.
Find your sensitive data before someone else does.
Start with a one-hour scoping call. First findings are delivered within 48 hours of access.