Sentra Data Security Platform

Assigns risk scores to discovered data based on sensitivity, access exposure, and configuration, then continuously monitors access patterns and policy compliance to surface the highest-risk data stores for action.

Discovers and classifies sensitive data (PII, PHI, payment data, IP, secrets) across structured and unstructured stores by combining deterministic techniques such as patterns, keywords, and validators with AI/ML techniques such as unsupervised clustering and small language models. Breadth of the technique blend, and whether classification extends to prompts, model outputs, and vector databases, are the primary differentiators; products that rely on pattern matching alone sit at the low end.

Extends access analysis to non-human AI identities, mapping which AI agents, copilots, and stand-alone models can reach which sensitive data stores and flagging over-broad or unsanctioned model access before it is exploited. Coverage of agent frameworks and model identities, and whether findings feed entitlement right-sizing before an AI rollout, vary across products.

Baselines how users and service accounts normally access sensitive data stores and flags unusual access behavior in real time, such as mass downloads, off-hours access, or first-time access to regulated data, with detailed audit logs for investigating insider risk and compromised accounts. Often sold as data detection and response (DDR); products differ in whether detection uses ML baselining or static rules.

Identifies sensitive data in locations outside authorized data stores, development databases containing production PII, unprotected S3 prefixes, forgotten data lake partitions.

Maps effective permissions to sensitive data stores across cloud IAM, database roles, and SaaS permissions, identifies over-privileged access and dormant entitlements.

Maps how sensitive data moves and transforms through AI pipelines, including model training sets, third-party AI API calls, prompts and model outputs, and vector databases holding embeddings, and flags where regulated data is exposed to a model or a downstream AI service. Depth of coverage for embeddings, fine-tuning data, and third-party AI platforms varies across products.

Discovers and classifies sensitive data held in on-premises estates without first migrating it to cloud: Windows file servers, SharePoint Server, NAS, self-managed relational databases such as SQL Server, Oracle, PostgreSQL, and MySQL, and mainframe environments including Db2. Cloud-first products often cover these sources slowly or not at all; depth of mainframe and legacy coverage is a primary differentiator.

Identifies sensitive data flowing into large language models and AI assistants such as Microsoft Copilot and ChatGPT, and enforces which generative AI services may use it, in which geographic region, and under which entitlements, reporting unsanctioned AI use. Right-sizing entitlements to stop oversharing before an AI assistant is rolled out is the most common form; blocking is usually delegated to DLP.

Discovers and classifies sensitive data across a heterogeneous cloud estate in one inventory: object storage, managed data warehouses and lakes, cloud database services, and SaaS applications, including sources that are not supported out of the box through custom connectors. Breadth of supported sources and depth per source vary; on-premises and mainframe estates are covered under On-Premises and Mainframe Data Discovery.

Traces the lineage of sensitive data across its life cycle, from origin through movements and transformations between storage locations, services, and users, surfacing unexpected cross-region transfers, shadow copies, and retention policy violations. Lineage depth (table and column level versus store level) varies; AI pipelines are covered under AI Pipeline Data Security.

Verifies that the organization's sensitive data is stored and processed only in approved geographic regions, mapping discovered data locations and cross-region transfers to applicable residency requirements (GDPR and the EEA, Australian Privacy Act, sectoral data localization laws) and to rules on where AI services may process it. Distinct from Data Sovereignty Controls, which governs where the scanning product itself handles content.

Acts on discovered data risks either natively or by orchestrating third-party DLP, IAM, EDRM, and ticketing controls: revoking over-permissioned access, quarantining or moving misplaced data, encrypting or masking unprotected files, and applying protection labels. Whether actions execute natively or only through integrated tools, and the breadth of available actions, are the primary differentiators; many DSPM products still leave enforcement to the integrated control.

Identifies sensitive data as it is created or moves through real-time data flows and pipelines, keeping the inventory current between full scans instead of relying solely on scheduled connector-based rescans of data at rest. Continuous discovery at petabyte scale is an architectural differentiator; most products rescan on a schedule.