Data Classification
Know what data is exposed. Per asset, with evidence.
Elastio finds sensitive records and exposed credentials in supported data sources. Use the findings with your policies and business context to decide what belongs there and what needs action.
The same analysis that finds ransomware finds your sensitive data.
No second tool to buy or run.
Data classification evidence from Elastio. Account identifier redacted.
files
- Financial11
- PCI11
| Path | Categories |
|---|---|
| /exports/2024/billing/cards-q4.csv | |
| /exports/2024/billing/cards-q4.parquet | |
| /exports/2025/billing/refunds-q1.json | |
| /exports/2025/billing/ledger-0003.pdf | |
| /exports/2025/billing/report-0004.pdf | |
| /exports/2024/billing/doc-0005.pdf | |
| /exports/2024/billing/ledger-0006.pdf | |
| /exports/2025/billing/users-0007.xlsx |
Where is your sensitive data right now?
Customer exports get left in shared folders. Old archives keep records nobody meant to keep. That question usually comes up after an incident, when it is hardest to answer.
247 daysThe average time to identify and contain a breach in IBM’s 2026 report. Knowing where sensitive data resides helps your team assess what may be exposed.1
Passwords and keys in your data are a way in.
Cloud keys, private certificates, and environment files left in your data give an attacker a way in, or a way back in. Elastio finds them so you can rotate them before someone uses them.
64%of valid secrets exposed on public GitHub in 2022 still worked in January 2026. A key nobody finds is a key nobody rotates.2
Pick the data types. Elastio finds them.
01Choose data types and regions
Pick the types of data to look for on the assets in scope, and the regions you operate in. Leave types unselected to look for all of them.
02Elastio reads the data
Elastio reads the contents of files in your data.
03Your team acts
Send each finding to the data owner to move, delete, or lock down the files.
Data types
- 01
Personally identifiable information
National ID, passport, and driver's license numbers, and other personal identifiers, tuned to the regions you select
- 02
Financial data
Bank account numbers and other financial records
- 03
PCI DSS
Payment card numbers and cardholder data
- 04
HIPAA
US protected health information
- 05
UK National Health Service
NHS numbers and related patient identifiers
- 06
Canadian Health Service
Provincial health card numbers
- 07
Health care
Health care records outside HIPAA and national health services
- 08
Passwords and keys
Cloud access keys, private keys and certificates, API tokens, and environment and configuration files
Tuned to where you operate.
ID formats differ by country, and some by state or province. Select the regions you operate in, or use Global to cover all of them.
- GlobalDefault
- Universal
- Americas
- USA
- New York
- Canada
- British Columbia
- Alberta
- Ontario
- Quebec
- Mexico
- Brazil
- Europe
- Europe
- UK
- Ireland
- France
- Germany
- Spain
- Italy
- Belgium
- Netherlands
- Switzerland
- Poland
- Sweden
- Denmark
- Finland
- Norway
- Asia Pacific
- Australia
- New Zealand
- Japan
- Hong Kong
- Singapore
- India
- Indonesia
- Malaysia
- Africa
- South Africa
“We know where the sensitive data in our environment sits, we treat it as a security finding when it is out of place, and we can show the evidence per asset.”
Know what was found. Apply your policy.
A sensitive-data finding establishes the detected content and its location. Whether that location is permitted depends on your access rules, retention requirements, and business purpose. Review the source evidence before classifying the exposure or assigning remediation.