DataAI Command Platform

Assigns risk scores to discovered data based on sensitivity, access exposure, and configuration, then continuously monitors access patterns and policy compliance to surface the highest-risk data stores for action.

Discovers and classifies sensitive data (PII, PHI, payment data, IP, secrets) across structured and unstructured stores by combining deterministic techniques such as patterns, keywords, and validators with AI/ML techniques such as unsupervised clustering and small language models. Breadth of the technique blend, and whether classification extends to prompts, model outputs, and vector databases, are the primary differentiators; products that rely on pattern matching alone sit at the low end.

Produces audit trails and regulation-mapped reports such as GDPR, HIPAA, and PCI DSS data inventories from discovery and access findings, with alerts on policy violations, so that evidence of data-handling practices can be handed to auditors without manual assembly. Custom and stakeholder-specific reporting is a common weak spot across products.

Extends access analysis to non-human AI identities, mapping which AI agents, copilots, and stand-alone models can reach which sensitive data stores and flagging over-broad or unsanctioned model access before it is exploited. Coverage of agent frameworks and model identities, and whether findings feed entitlement right-sizing before an AI rollout, vary across products.

Identifies sensitive data in locations outside authorized data stores, development databases containing production PII, unprotected S3 prefixes, forgotten data lake partitions.

Maps effective permissions to sensitive data stores across cloud IAM, database roles, and SaaS permissions, identifies over-privileged access and dormant entitlements.

Maps how sensitive data moves and transforms through AI pipelines, including model training sets, third-party AI API calls, prompts and model outputs, and vector databases holding embeddings, and flags where regulated data is exposed to a model or a downstream AI service. Depth of coverage for embeddings, fine-tuning data, and third-party AI platforms varies across products.

Discovers and classifies sensitive data held in on-premises estates without first migrating it to cloud: Windows file servers, SharePoint Server, NAS, self-managed relational databases such as SQL Server, Oracle, PostgreSQL, and MySQL, and mainframe environments including Db2. Cloud-first products often cover these sources slowly or not at all; depth of mainframe and legacy coverage is a primary differentiator.

Identifies sensitive data flowing into large language models and AI assistants such as Microsoft Copilot and ChatGPT, and enforces which generative AI services may use it, in which geographic region, and under which entitlements, reporting unsanctioned AI use. Right-sizing entitlements to stop oversharing before an AI assistant is rolled out is the most common form; blocking is usually delegated to DLP.

Discovers and classifies sensitive data across a heterogeneous cloud estate in one inventory: object storage, managed data warehouses and lakes, cloud database services, and SaaS applications, including sources that are not supported out of the box through custom connectors. Breadth of supported sources and depth per source vary; on-premises and mainframe estates are covered under On-Premises and Mainframe Data Discovery.

Traces the lineage of sensitive data across its life cycle, from origin through movements and transformations between storage locations, services, and users, surfacing unexpected cross-region transfers, shadow copies, and retention policy violations. Lineage depth (table and column level versus store level) varies; AI pipelines are covered under AI Pipeline Data Security.

Acts on discovered data risks either natively or by orchestrating third-party DLP, IAM, EDRM, and ticketing controls: revoking over-permissioned access, quarantining or moving misplaced data, encrypting or masking unprotected files, and applying protection labels. Whether actions execute natively or only through integrated tools, and the breadth of available actions, are the primary differentiators; many DSPM products still leave enforcement to the integrated control.

Enriches classification results with context beyond the content itself, such as data lineage, effective permissions, storage location, owner, and business metadata, so that a record is labeled by what it is and how it is used rather than by pattern matches alone. Depth of contextual inputs, and whether they change the assigned sensitivity, vary widely across products.

Maps effective permissions to sensitive data stores, identifying every identity with access, at what level, and whether that access has been used recently.

Generates access certification campaigns for data owners and custodians, routing entitlement lists for review, tracking decisions, and triggering revocation for uncertified access.

Identifies sensitive data sets with no active owner, no recent access, or no business justification for retention, surfacing candidates for deletion or archival.

Consumes sensitivity labels from data classification tools (Purview, Varonis, Nightfall) to apply access governance policies based on data sensitivity tier.

Implements IAB Europe TCF v2.2, encoding user consent through the TC String and Global Vendor List for CMP certification in EU programmatic advertising.

Connects to multiple preference repositories with bidirectional synchronization and configurable collision-resolution rules backed by prebuilt connectors and APIs.

Hosts a self-service center where individuals manage granular communication and data-use preferences over time (channels, topics, and purposes), with those choices enforced across connected systems.

Pushes stored consent decisions into tag managers and ad platforms (Google Consent Mode v2, GTM) so downstream tags fire only for permitted purposes.

Crawls the site to discover all cookies and tracking technologies in use, categorizes them by purpose (strictly necessary, analytics, marketing), and maintains the cookie declaration.

Stores an immutable record of consent transactions (what consent was given, when, to which version of the privacy notice, from which IP and session), as required for GDPR accountability.

Handles GDPR opt-in, CCPA/CPRA opt-out, LGPD, and other jurisdiction-specific consent regimes from a single implementation, applying the correct consent model based on visitor geolocation.

Manages privacy breach response and regulatory notification workflows within mandated timelines.

Assesses third-party processors and sub-processors against GDPR data processing agreement requirements and privacy control standards before data sharing.

Automates timed deletion and lifecycle enforcement so personal data is erased across connected systems when its retention period or lawful purpose ends, independent of an inbound request.

Discovers personal data processing activities and their associated data flows, systems, and third-party transfers: the foundation for GDPR Article 30 Records of Processing Activities.

Captures, stores, and versions consent records with purpose, legal basis, and timestamp, providing auditable proof of consent for data processing activities.

Automates intake, identity verification, routing to data owners, and fulfillment of GDPR, CCPA, and LGPD data subject requests, access, deletion, portability, and correction.

Serves compliant cookie consent banners, stores granular consent by category, and integrates with analytics and ad tech platforms to enforce user consent preferences.

Provides structured DPIA workflows with pre-built templates for common processing activities, routing for DPO review, and documentation of risk mitigations.

Captures and tracks the data used by AI entities over time, including training-data provenance and lineage via data governance integration.

Classifies, assesses and mitigates AI-specific risks such as bias and robustness, with content libraries for regulations and frameworks including the EU AI Act, NIST AI RMF and ISO 42001.

Enforces AI policies at runtime through guardrails, access controls and use-case validation, with remediation recommendations and compliance reporting.

Maintains a centralized, discoverable registry of all AI use cases, applications, agents and models with metadata, ownership and deployment status.

Handles data subject requests under GDPR, CCPA/CPRA, LGPD, and other privacy laws from a single intake workflow, applying jurisdiction-specific handling rules and response timeframes.

Queries connected data sources (CRM, email, databases, SaaS apps) to locate personal data for a given subject, automating the data retrieval step of access and deletion requests.

Verifies data subject identity using configurable verification methods (email OTP, ID document check, account authentication), before disclosing or deleting personal data.