Platform Safexa Consent Safexa Discover The DPDP Act Readiness check Security & architecture Company Book a walkthrough
Safexa Discover

You cannot govern data
you have not found.

Erasure you cannot execute. An access request you cannot answer completely. A breach you cannot scope. Every one of those failures traces back to the same root cause — nobody knows where the personal data actually is. Not where it was designed to be. Where it ended up.

Book a walkthroughCheck your readiness
Structured

Postgres, Oracle, MySQL, SQL Server, MongoDB, Snowflake, Redshift, BigQuery, Databricks — and anything with a JDBC driver.

Unstructured

S3 and Blob, SMB and NFS shares, SharePoint, Google Drive, mail archives, scanned documents with OCR.

SaaS

Salesforce, Zoho, Freshworks, HubSpot, Zendesk, ticketing and campaign platforms — where a surprising amount of it hides.

Pipelines and logs

Kafka topics, ETL staging tables, application logs. The places personal data is not supposed to be, which is exactly why they matter.

Classifiers built for India

Aadhaar is not a nine-digit US pattern.

Detection tuned for the identifiers Indian systems actually carry, with checksum validation where the format has one, so a column of random twelve-digit numbers is not reported as four hundred thousand Aadhaar numbers.

Aadhaar · VerhoeffVIDPAN Driving licenceVoter IDPassport GSTINIFSCBank account UPI VPAPolicy numberClaim number UAN · PFABHAMobile · E.164 IN Vehicle registrationHealth recordsBiometric refs

Sensitivity is assigned per category, and health, financial and claims data are treated as elevated throughout the platform — separate access logging, and mandatory inclusion in the Significant Data Fiduciary audit sample.

scan · crm-prod · completed 11 min ago
store postgres://crm-prod/public tables 412 scanned · 61 with personal data customers.pan_number PAN 412,884 customers.mobile MOBILE 418,201 kyc_docs.aadhaar_masked AADHAAR 389,110 claims.medical_summary HEALTH 44,207 exports_2023.csv_dump MIXED 1,204,880 findings ! exports_2023 has no owner and no purpose mapping ! claims.medical_summary readable by 214 roles ! 88,410 rows past retention on RENEW-MKT-03
Flow, not inventory

Where it came from, and everywhere it went.

An inventory tells you a column holds PAN numbers. A flow map tells you that column feeds a nightly export to your campaign platform, which is a processor you have not contracted under Section 8(2), and that the data crossed no border on the way.

  • ●Purpose linkage — every store mapped to the purpose the data was collected under, so erasure and retention have something to act on.
  • ●Recipient discovery — the processor list a Section 11 access request actually requires, derived rather than remembered.
  • ●Retention exposure — data held past the period on its purpose, with the legal basis named or flagged as missing.
  • ●RoPA that stays true — regenerated from each scan rather than maintained by hand until it quietly stops matching reality.
retention exposure · top findings
1.2M rows in an unowned CSV export
No purpose mapping, no retention period, no owner. Cannot be erased on request because nothing knows it exists.
s.8(7)s.11
88,410 rows past retention on a marketing purpose
Two-year period elapsed. A live contravention for as long as it continues.
s.8(7) + Rule 8
Health data readable by 214 roles
Access breadth on an elevated category, with no documented justification.
s.8(5) + Rule 6

Bring us the question your counsel and your CTO disagree about.

Those are the conversations worth having before anyone signs anything.

Book a walkthrough Open the live console

Or email safexa@teknowxa.com directly — a person reads it.