Metadata-only reporting: how MyVaultMate finds PII without collecting it

There is a paradox at the center of data discovery. To protect sensitive data you have to find it, but a careless scan can copy that data into a report and spread the very risk it was supposed to reduce. Anyone considering a scanning tool should ask a plain question: what exactly leaves my computers, and what gets stored? Here are the answers for MyVaultMate, as plainly as we can state them.

What happens on the computer

A small program you run once on each machine keeps running in the background and scans on the schedule you set, on Windows 10 and 11 (64-bit) or Linux. It reads files in the drives, synced OneDrive or Google Drive folders and external disks that you chose. It reads Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files. It does not read pictures, videos, recordings or scanned PDFs; they are listed as “Not scanned” with a risk score of 70. The files and the full values it finds stay on that machine. MyVaultMate never uploads them and never saves the full values anywhere else.

You control the scope. You choose which drives and folders are scanned and can remove any of them at any time. The default scan skips AppData and caches.

What a finding contains

For each finding, the dashboard receives:

• the file path and file type;
• the kind of data, such as Social Security number, payment card, driver's license, passport, date of birth, medical record number, Medicare number, insurance member ID or a health-information signal;
• the severity, from Critical to Low;
• the compliance frameworks involved;
• at most a short redacted sample, up to 64 characters, such as ***-**-1234;
• the file's size and date, where in the file the finding is, the label next to the value (such as DOB), and a one-way fingerprint of the file.

Each computer also sends its name, machine ID, operating system, program version and the email of the account that signed it in. If file names include client names, switch on Keep file names off the dashboard and the dashboard gets tags instead. No field for scan results holds a full value. That is a design decision, not a setting someone can flip. A report that tells you "this spreadsheet has many distinct SSNs, and here is its path" gives you what you need to act without gathering a copy of those numbers in one place.

What this means for risk

• Smaller blast radius. The dashboard is not a store of plaintext SSNs and card numbers.
• Easier to explain. When a client, insurer or reviewer asks how the scanning tool handles their data, the answer is short.
• Easier to adopt. Staff and owners are more willing to scan everything when the scan does not create a new pile of sensitive material.

How it is protected in transit and at rest

Findings are sent over TLS. The database and backups are stored encrypted, on US-based hosting. Staff access to dashboards is role-gated and logged. You can read the full description at /security/. As with any service, none of this replaces your own security program, and the product does not make your office compliant.

What it does not do

Honesty about limits is part of trust, so here they are:

• It finds and ranks. It fixes nothing and moves or deletes nothing on its own. That is your job or your IT provider's.
• Detection is rule-based. Occasional false alarms happen, and a human should look at the top findings.
• Driver's license, passport and date-of-birth values are caught only when they sit next to a label such as "DL no.," "passport" or "DOB."
• Medical record numbers and insurance member IDs are found only next to their labels, because every records system and insurer uses its own format. The health keyword signal says a file reads like a medical record; it does not identify individual records.
• RTF and PowerPoint files, Outlook .pst data files, and zip archives are not scanned yet.
• The Windows file is not code-signed yet, so SmartScreen may warn on first run ("More info," then "Run anyway").

Questions worth asking any vendor

1. Do the full values ever leave my computer?
2. Is there any field where a raw value could be stored?
3. Who can see my dashboard, and is that access logged?
4. Can I remove a folder or drive from the scan at any time?
5. What does the tool not do?

You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).