TotalHealDataShield

How it works

1. TeachChoose regulation templates; add your records, confidential documents and codenames — kept only as hashes.
2. InspectServers daily and on demand, cloud drives and sent mail every five minutes, applications through the scan API.
3. ValidateChecksums, context words and thresholds keep ordinary numbers out of the findings.
4. See exposureEvery finding shows who can reach it: anyone with a link, outside recipients, every user of a server.
5. ContainRemove public links or take file access away after a second person approves; resolve or accept the rest.

Reference architecture

Key capabilities

• 25 detectors, validatedAadhaar (Verhoeff check digit), PAN (holder type), GSTIN (check character), bank account numbers next to account words, IFSC, UPI IDs (known bank and app handles), Indian mobile numbers, passport, voter ID (EPIC) and driving-licence numbers, payment cards (Luhn and real network prefixes: Visa, Mastercard, RuPay, Amex, Discover, Diners, JCB), IBAN (mod-97), SWIFT, US SSN, e-mail addresses — each with context words that raise its confidence; repeated and sequential test numbers are ignored.
• Secrets and keysPrivate keys (RSA, EC, OpenSSH, PGP), AWS access keys, GitHub, Slack and Google API tokens, Stripe and Razorpay live secret keys, JSON Web Tokens, database and broker connection strings with passwords, Azure storage keys and passwords in configuration files (placeholders ignored).
• Exact data matchUpload a CSV of your customers, patients, employees or accounts: DataShield keeps only salted hashes and finds files holding two or more fields of the same record, however the numbers are written.
• Document fingerprintsRegister a board paper, contract or design: files that copy a share of its text are found, even with other text around it. Only hashes of the document are kept.
• Keyword dictionariesCodenames, project names and labels such as “Strictly confidential”, matched as whole words in any case.
• Text from real filesWord, Excel and PowerPoint (Office Open XML), OpenDocument, PDF text, CSV, JSON, XML, HTML, e-mail with attachments, and zip archives nested up to three levels; legacy Office files by their text; password-protected files reported, never silently skipped; archive bombs refused.
• Policies for regulationReady templates for the Aadhaar Act, PCI DSS, the DPDP Act 2023 (bulk personal data), Indian financial identifiers, credentials and GDPR / GLBA, and your own policies: data types with minimum counts and confidence, your records, documents and words, per channel — edited in the console, never as JSON.
• Servers: data at restThe TotalHeal server agent inspects the folders you choose on every Linux server every day and on demand, reads only new or changed files, never follows links and never reads system trees, and reports who owns each file and whether every user of the server can read it.
• OneDrive, SharePoint and Google DriveChanged files in every user’s drive (and every SharePoint site library) are inspected every five minutes, with how each is shared: a link anyone can open, people outside your domains, the whole organisation or nobody. Google Docs, Sheets and Slides are inspected through their text.
• Mail that leavesEvery sent message and its attachments in Microsoft 365 and Gmail is inspected; recipients outside your domains make the finding exposed.
• Scan APIPOST any file or text to the scan API from your applications, upload paths or CI and get the verdict, the masked findings and the policies broken; record the result as a finding if you choose.
• Masked evidenceA full sensitive value never leaves the inspection: findings keep the count, the confidence and up to three masked samples (•••• •••• 9012), the file and the part of an archive or attachment it was in.
• Take access away, with approvalOn a server, group and other users lose access to a flagged file and its old permissions are journaled so it can be put back; in Microsoft 365 or Google Drive, public links and outside shares are removed while shares inside the organisation stay. Every change needs a second person — never the requester, never a service account.
• Findings that stay currentResolve, accept the risk with an expiry, or reopen; files that are deleted or cleaned are resolved by the next scan, and a finding that comes back reopens.
• Alerts in the same incident queueA new finding that breaks a policy becomes an alert (credentials in files: MITRE ATT&CK T1552.001) correlated with endpoint, identity and cloud alerts and sent on to your SIEM, ticketing and playbooks.

In the console

Deployment options

System requirements

Technical specifications