Discover agent
Find the Aadhaar numbers hiding in your own databases
Your website is only half the story - the Act cares about the data you already hold. Discover is a small open-source tool your team runs on its own machines. It scans your databases and spreadsheet folders for Indian personal data, validated by checksum rather than guessed by column name, and tells you which columns need encryption, masking, or retention rules. The data never leaves your systems.
npx @privacyready/discover --files ./exports # or scan a database with a read-only login: npx @privacyready/discover --postgres "postgres://readonly:...@host/db"
Works completely offline. Add --key from your workspace to see results in your dashboard - the report holds table names, column names, and counts. Never a value.
How it works
Run it where the data lives
One command on the machine that can reach your database or export folders. No install, no account needed to try it.
It validates real values, locally
Aadhaar carries a checksum; PAN has verifiable structure. Discover samples rows and checks the mathematics - so Aadhaar numbers in a column called “notes” still get found.
You get duties, not data
Each finding names its column, count, and what the Act expects - encrypt, mask, set retention. With a workspace key, findings appear in your dashboard’s Live scans.
Metadata only, by construction
The report format has no field that can hold a value, and the test suite plants canary values that must never appear in output - the build fails if they do.
Read-only and quiet
SELECT-only queries with row limits and timeouts; run it with a read-only database login. No telemetry, no update checks, no phoning home.
Open source for audit
The full source is public on GitHub under the MIT licence - your security team can verify every claim on this page.
What it finds today
Aadhaar numbers (Verhoeff checksum-verified), PAN, UPI IDs, IFSC codes, Indian mobile numbers, email addresses, PIN codes, and dates of birth - across PostgreSQL, MySQL, and folders of CSV or Excel files. It also checks whether a column already looks protected (hashed or encrypted) so you act on the right ones first. Findings are automated signals to investigate, not a legal determination.
Dashboard uploads on Growth and above
Anyone can run Discover offline, free, forever. Growth plans connect it to your workspace: scan history, unprotected-column alerts, and findings beside your website checks - 2 data sources on Growth, 10 on Business.