Find personal data before someone else does

What Guardian looks for

• Indian identifiers such as Aadhaar and PAN numbers.
• Payment card numbers.
• Secrets such as passwords, keys and tokens left in configuration files and exports.
• Exports and backups that hold personal data in folders you choose to scan.

Values never leave your servers

The scan runs inside the Guardian agent on your own server. Guardian receives counts and file locations, not the values. The console can tell you that a file holds two hundred PAN numbers, but Guardian never sees those numbers. Guardian sees threats, not your data.

The Data Protection Report

The console turns scan results, alerts and protection status into a Data Protection Report, laid out against the duties a data fiduciary has under the Digital Personal Data Protection Act. For each area it shows what Guardian observed and a suggested next step.

• Reasonable security safeguards: encrypted volumes, removed exposed files and protected public sites.
• Knowing your data: where personal data sits, so each file can be given a purpose and an owner.
• Retention: exports and backups that may be older than they need to be.
• Breach notice: high-severity alerts from the last 30 days to review when assessing whether a breach occurred.
• Evidence: a timestamped, tamper-evident record of what Guardian observed.

What the report is, and is not

The report supports your DPDP obligations and gives your data protection officer and auditors something concrete to work from. It is not legal advice and does not certify compliance. Your organisation remains responsible for its decisions.

Getting started

Install the Guardian agent on a server and point it at the folders that hold exports, uploads or backups. Results appear in the console, alongside your website and server protection.

Why this matters now

Under the DPDP Act, organisations that process personal data are expected to protect it with reasonable safeguards, keep it no longer than needed and inform the Data Protection Board and affected people when a breach happens. None of that is possible without knowing where the data is. In most organisations, personal data spreads quietly: an admissions export emailed to a vendor, a patient list saved to a shared folder, a backup left on a web server after a migration.

Guardian gives you a regular, factual picture of where that data sits on the servers you choose, so the people responsible can make decisions.

Alongside website and server protection

Data protection works best with the rest of Guardian. Website protection refuses common attacks before they reach your server, and exposure scans show files that anyone can download. The server agent watches for unexpected changes and suspicious sign-ins on the same machines that hold the data. All of it appears in one console with the same team roles and audit log.

Who uses it

Data protection is useful anywhere personal data piles up on servers: hospitals with report and billing exports, universities and schools with applicant and student lists, government departments with citizen records, and banks with statements and customer files. It is also useful during and after a migration, when old copies are most likely to be left behind.

Questions

Does Guardian copy our personal data?

No. The scan runs on your server and Guardian receives only counts and locations, never the values.

Does this make us DPDP compliant?

No tool can do that on its own. The Data Protection Report supports your obligations and shows what safeguards were in place. It is not a certification.

Which folders should we scan?

Start with folders that hold exports, uploads, backups and anything served by a web server. You choose the folders when you install the agent.

What should we do with what it finds?

Confirm each file has a purpose and an owner, then move, encrypt or delete what is not needed. The report suggests a next step for each area.