Can we revoke access to a file that’s already on a former employee’s personal device?

Yes — immediately and without an endpoint agent. The encryption is embedded in the file, not enforced at the storage or network layer. When you revoke authorization, the encrypted fields on any local copy — laptop, personal drive, backup — lock instantly. The file still exists. The sensitive content inside it becomes computationally inaccessible.

An employee just pasted client data into ChatGPT. Is that gone?

Without data-layer protection, that content entered the provider’s infrastructure and may sit in inference logs or fine-tuning pipelines. With AI Guard, sensitive fields are redacted before the prompt is sent — regardless of which AI tool the employee uses. The model receives context. The sensitive data never leaves your environment.

When a contractor’s engagement ends, do we revoke every file by hand?

No. Access policies can expire automatically at a set date or on an offboarding trigger. When the policy expires, encrypted fields lock across every device the contractor ever opened them on — no file-by-file step, no requirement that they return or delete anything. The data inside is simply no longer accessible.

How do we demonstrate insider-risk controls to auditors?

Confidencial maintains cryptographic audit trails recording who accessed which fields, in which document, when, and from which device. That’s a verifiable chain of custody for NIST 800-53, ISO 27001, SOC 2, and CMMC — the field-level evidence behavioral alert logs and folder-level histories can’t provide.

Sensitive Data Risk Assessment

How it works

STEP 01 FIND IT. CLASSIFY IT.

Get a high-level view of your risk.

Choose an on-prem or cloud data source, and we’ll scan your data. Our engine analyzes your data, pinpointing exactly where sensitive information resides at the document and field level.

Amazon S3OneDriveAzure BlobGoogle DriveBox

SCAN COMPLETE · 100GB4,312 sensitive files found

PII

1,847

HIPAA

892

PCI-DSS

634

GDPR

939

Top exposed locations

s3://prod-docs/contracts/847 files

OneDrive / HR / Compensation312 files

SharePoint / Finance / Q4204 files

FINANCIAL RISK PROJECTIONSHigh exposure

$2.1M

Estimated breach cost based on current exposure

197

Median days to contain if breach occurs today

$340K

Est. dark-web value of exposed records

Active compliance frameworks at risk

Compliance risk status

GDPR Article 32High risk

HIPAA Security RuleMedium risk

PCI DSS Req. 3High risk

STEP 02 ASSESS THE RISK

Understand the financial impact of your exposure.

Our multi-layered analysis engine identifies the type of sensitive data, assesses compliance risk, and quantifies your business exposure, estimating recovery time, black market value, and potential financial impact if leaked.

This gives you a data-driven business case for stronger security investment in exact dollar terms.

STEP 03 YOUR REPORT

Get a detailed, actionable risk report.

You’ll receive a report jam-packed with insights to reduce vulnerabilities, strengthen controls, and stay ahead of evolving threats and regulations.

Where PII, PCI, GDPR, and HIPAA data is stored

High-risk formats lurking in your storage environments

A roadmap to prioritize fixes and avoid compliance pitfalls

A maturity curve assessment to level up your data strategy

Financial risk exposure breakdown from unprotected data

Sensitive Data Risk Assessment

CONFIDENTIAL · Prepared by Confidencial · June 2026

Executive summary

Overall risk score

High

Key findings

4,312 files with sensitive data lack encryption

GDPR and HIPAA gaps identified — audit risk

3 immediate actions recommended (page 12)

Report sections

Data inventory & classificationp.4

Financial risk projectionsp.8

Compliance gap analysisp.11

Remediation roadmapp.15

Common questions

What to expect.

Everything you need to know before you submit the form.

What does the assessment include?

Data discovery across one data store, sensitive data classification and labeling, identifying regulated data types (PII/PCI/HIPAA/GDPR), and actionable recommendations for improving your data security posture.

Will Confidencial ever see my data?

No. Our analysis engine performs a blind scan of your connected data store. We don’t see, copy, or store any of your sensitive data. If you prefer to host the assessment engine yourself, we can accommodate that with a bit more setup.

What data sources and file types are supported?

Amazon S3, Azure Blob, OneDrive (SharePoint), Box, Google Drive, and Google Compute. File types include PDF, Word, and dozens of text file formats.

How much data can I scan?

One data source with up to 100GB of data, at no cost.

Will this disrupt my operations?

Not at all. Discovery scans occur seamlessly in the background while you run your business as usual.

I’ve received my report — now what?

Use the insights to prioritize and address gaps. If you partner with us, you get access to dashboards and tools for reviewing your risk profile in real time — not just a one-time snapshot.

Is this a one-time process?

The free assessment is a one-time scan, but regular assessments are needed to maintain security and compliance as threats, technologies, and regulations evolve. Ongoing customers get real-time risk dashboards instead.

You can't protect what you can't see.