Piiano Scanner

A privacy code scanner is a tool that statically analyzes and scans your source code to identify references to and usages of sensitive data. It is helpful in order to get visibility (sensitive data posture) into privacy violations and track relevant code changes over time.

Piiano Scanner lets you find references to PII and other customers’ sensitive data in your source code in minutes instead of weeks of manual work. Knowing which sensitive data types your application collects is necessary for the following tasks:

1. You want to improve the security of sensitive data, and you aren’t 100% sure which customers’ sensitive data your application collects.
   You’re building a data catalog, and you want to quickly identify all the customers’ sensitive data that your application collects.
2. You’re conducting a PIA (Privacy Impact Assessment) or DPIA (Data Protection Impact Assessment), and you want to identify customers’ sensitive data within your source code to understand the risk and mitigate it.

Piiano Scanner will provide you:

1. A list of customers’ sensitive data types (PII/PCI/PHI) that the application collects, together with the sensitivity level for each type; e.g., it will identify the collection and usage of names, addresses, emails, bank account numbers, passwords, phone numbers, SSNs, credit card numbers, and many more.
2. For each type of sensitive customer data, it will show you its declaration (class member) and all its usages within your code, together with code snippets and links to your GIT. Knowing which sensitive data the application collects is the first step towards hardening security and privacy. This can be achieved using Piiano Vault.
3. A list of log leaks. Log leaks are lines of code where the application writes sensitive data to external logs. This creates an exposure risk for your clients and your company and should be avoided. Not to mention that it violates privacy compliance, where you should be able to control all sensitive data. You can use these insights to make sure that the log level that is used is “debug” and not production, or remove/obfuscate identifiers before they’re logged.
4. A list of 3rd-party API calls that will help you ensure that sensitive data is shared only with companies that are compliant with relevant privacy regulations, such as GDPR and CCPA, and that customers’ consent is honored in the relevant cases in the code.

Piiano PII Scanner can speed up both PIA (Privacy Impact Assessment) and DPIA (Data Protection Impact Assessment) processes by:

1. Identifying which PII types your organization collects.​
2. Ensuring the collection of necessary PIIs is in line with your stated policy.
3. Identifying with which 3rd party vendors you share PIIs and verifying their compliance.

Once the Piiano Scanner provides visibility into the risk that comes with the liability of collecting PIIs, you can start protecting this data with our vault. The Piiano Vault provides the ability to securely store the collected PIIs and simplify the compliance implementation for this data.

Data catalogs help data users make better-informed decisions about their organization’s data usage, detailing what data types are stored, where they are, how they are kept and who has access to them, among other things. Data catalog software typically includes a data discovery tool and a data classification tool which require access to production environments.

The Piiano Scanner complements classical data discovery through scanning code by:

1. Supplementing existing data catalogs as a primary code discovery tool that focuses on
   sensitive customer data, such as PII, PHI, and PCI.
2. Jump-starting an organization’s entire understanding of sensitive customer data usage and
   privacy posture.

The Piiano Scanner allows you to perform PII discovery in minutes, using only a connection to your GitHub repo.