Sensitive data discovery
Find possible SSNs, ITINs, payment cards, bank details, credentials, private keys, health information and more. Add custom detection rules. Confidence levels and masked evidence keep findings in context.
OUR FIRST OPEN SOURCE PROJECT
Your data.
Your network.
Your visibility.
Meet OpenSource DataScope.
Find sensitive data. Understand who can access it.
Put governance into practice, without a software license bill.
Free to use Apache License 2.0 Runs inside your network
FROM UNKNOWN TO UNDERSTOOD
Turn scattered data
into a clearer picture.
Follow the path from discovery to informed access decisions.
DISCOVER
See what’s hiding in plain sight.
Scan Windows SMB shares by file contents, not just filenames. Find potential sensitive information in documents, mail archives, compressed files and scanned pages.
Possible matches, with confidence and masked evidence.
01Windows file shares
02Content readers + local OCR
03Sensitive data findings
UNDERSTAND
Follow every access path.
Connect share permissions, NTFS rights and Active Directory memberships to understand who can reach your data and why. Nested groups, loops and unresolved identities stay visible.
Incomplete visibility is reported, never treated as certainty.
01Active Directory groups
02Share + NTFS permissions
03Effective access insight
REVIEW
Give decisions to the right people.
Let data owners review access from a frozen snapshot. Capture their decisions, create tasks for IT, and use a later scan to verify that permission changes have actually happened.
DataScope records decisions. Your team makes the changes.
01Data owner review
02IT remediation task
03Verification on rescan
THE CAPABILITIES
Real insight.
Practical governance.
Purpose built for Windows file shares
and on premises Active Directory.
Access you can explain
Read share and NTFS permissions alongside Active Directory groups. Trace nested memberships and individual access paths, with unresolved accounts and incomplete answers clearly flagged.
Exposure and risk
Explore exposure maps, prioritize findings with risk triage, and identify stale or duplicate data. Connect findings to compliance standards with evidence reports.
Reviews with real owners
Assign data owners and run campaigns from frozen snapshots. Record keep, remove, investigate or exception decisions. Create IT tasks and verify external changes with the next scan.
File activity and alerts
Read Windows Security logs for deletions, permission changes and refused access. Flag unusual behavior against learned activity patterns. Requires the appropriate Windows audit configuration.
Evidence you can use
Bring together held information for a subject access request. Track progress, review system health, and export CSV or printable reports backed by an append only audit log with a hash chain.
LOOK INSIDE MORE THAN TEXT FILES
Microsoft Office / PDF / Email / PST & OST / ZIP, 7z & RAR / Images with local OCR
Encrypted, corrupt and unsupported files are reported as coverage gaps.LOCAL BY DESIGN
It reads your data.
It doesn’t rewrite it.
OpenSource DataScope reads files, permissions and directory information. It does not change your source files, permissions or Active Directory. Your team stays in control of remediation.
Explore the architecture ↗YOUR NETWORK BOUNDARY
Windows file shares SMB
Active Directory LDAP
OpenSource DataScope LOCAL
No cloud dependency. No telemetry.
SECURITY BY DESIGN
Open source data governance.
Completely internal.
Visibility into sensitive data, with control kept inside your network.
No outside network reach
OpenSource DataScope operates entirely inside your network at runtime. It does not contact outside hosts, depend on a cloud service, or send telemetry. Content scanning and OCR happen locally.
Read only by design
The scanner reads source files, share permissions, NTFS permissions and Active Directory. It does not rewrite source contents or change permissions or directory memberships. Your administrators carry out remediation.
Controlled access and evidence
Windows authentication and application roles control access. Data owners review their assigned resources. Masked evidence, confidence levels and an append only audit log support accountable decisions.
BEFORE YOU START
Open code.
Clear expectations.
Everything you need to take the next step.
Is it really free?
Yes. OpenSource DataScope is available under the Apache License 2.0. There is no software license charge. You provide and operate the infrastructure.
What does it run on?
The documented target is Windows Server 2019, 2022 or 2025 in an Active Directory domain, with PostgreSQL 16 or 17. It scans SMB shares on Windows Server 2016 or later within the same domain. Read the platform and sizing guide for requirements and validation status.
Does it include Microsoft 365?
This project focuses on on premises Windows file shares and Active Directory. Microsoft 365, NAS appliances, Azure Files and multiple domain or forest environments are outside the current scope.
Is it ready for my production environment?
Start in a lab. The repository documents automated testing and remaining Windows domain lab checks. Review the acceptance status before relying on it. Sensitive data findings are possible matches, and compliance reports provide evidence rather than certification.
How can I help?
Contribute code, improve documentation, or share feedback from a lab with synthetic data. Start with the contribution guide. Report vulnerabilities privately using the repository’s security guidance.
START WITH VISIBILITY
Your first scan.
A clearer perspective.
Set up a lab, explore the source, and see what your data can tell you.