Questions an office manager should ask any scanning vendor

Software that reads your files is a bigger decision than software that prints your invoices. It touches the most sensitive material in the office, and the person approving it is often the office manager, not an IT department. You do not need a technical background to do this well. You need a short list of questions and the habit of asking for specific answers. Here is a vendor-neutral checklist you can use with any scanning product, followed by how MyVaultMate answers each one.

1. What leaves my machine?

Ask: Are my files uploaded? Are full values copied? What exactly is in the report? Does it include file names?

Good answers are specific. "We take privacy seriously" is not an answer. You want a list of fields. Be wary of any tool that uploads documents for analysis elsewhere, because each upload is a new copy of your data in someone else's hands.

MyVaultMate: the files and full values never leave the computer, and MyVaultMate never saves the full values anywhere else. Each finding carries the file path (or a tag, if file names are kept off the dashboard), kind of data, size, date, where in the file, the label next to the value, a fingerprint, severity, frameworks and at most a short redacted sample capped at 64 characters. Each computer also sends its name, machine ID, operating system, program version and the signed-in account's email. Paths can include people's names, so treat them as sensitive, or switch on Keep file names off the dashboard and each computer sends a tag in place of every file and folder name. See the walkthrough.

2. Where is it stored, and how is it protected?

Ask: Which country? Is it encrypted in transit and at rest? Are backups encrypted too?

MyVaultMate: data is sent over TLS, and the database and backups are stored encrypted on US-based hosting.

3. Who can see it?

Ask: Which of your staff can open my account? Is that access limited by role? Is it recorded?

MyVaultMate: staff access to dashboards is role-gated and logged. On your side, think about who in your own office should see the dashboard, because paths can reveal names.

4. How do I delete things?

Ask: How do I stop a folder being scanned? How do I remove a computer? How do I get my records deleted at the end, and how long does that take? Get the answer in writing.

MyVaultMate: you choose which drives and folders are scanned and can remove any of them at any time. Scan data is deleted 90 days after you cancel and billing records are kept 10 years; for anything else, email support@cmtechsoftware.io and we will confirm in writing; there are no raw values to remove, since none are held.

5. What does it need in order to run?

Ask: What operating systems? Does it need administrator rights, and how often? Does it run all the time? Is it a single file? Is the file signed? Will it slow our computers down?

MyVaultMate: Windows 10 and 11 (64-bit) and Linux on x86-64. Other systems, including Windows Server, are not supported. You download one file per system and run it; nothing is installed and no administrator rights are needed (only the optional Run as a service, for a computer nobody signs in to, asks for an administrator, once). Once it is signed in it starts watching by itself: a small background process that starts again after a restart. Choosing Stop watching and deleting the file removes it. Scans back off while someone is using the computer. The Windows file is not code-signed yet, so SmartScreen may warn on first run; choose "More info", then "Run anyway", and only do that for a file you got directly from your own dashboard.

6. What happens when I stop?

Ask: If I cancel, what happens to the software on my machines and to my data? Will I be charged automatically after a trial? Can I export my findings first?

MyVaultMate: the trial lasts 14 days, counted from your first computer. A card is required and saved, never charged automatically. When the trial ends, scanning pauses and you choose a plan, monthly or yearly; only then is the card charged. A reminder email goes out 3 days before the trial ends. If you never choose a plan, the account is closed after six months and its scan data deleted. Findings export to PDF, CSV and XLSX. To take the program off a computer, choose Stop watching and Unpair, then delete the program file.

Bonus questions worth asking

• What can it not find? Every honest vendor has a list. Ours: detection is rule-based, so there are occasional false alarms; some values (driver's license, passport, date of birth, medical record numbers, insurance member IDs) are found only next to a label; the health keyword signal is about a file, not identification of individual records; and some files are not read: RTF and PowerPoint files, Outlook .pst data files, zip archives, password-protected files, pictures, videos, recordings and scanned PDFs. Each is listed as “Not scanned” with a risk score of 70, never as clean.
• Will it fix things? If a vendor says it will clean everything automatically, ask what that means in practice, because automated moves and deletions can destroy records you must retain. MyVaultMate moves or deletes nothing on its own: anything done to a file is chosen by the person at the computer (for example, moving the pictures and other media files it could not read into one folder, or locking a risky file away in the quarantine folder).
• Does it make us compliant? No tool does. Be suspicious of anyone who says it will. A scanner can help document where sensitive data sits, which feeds your risk assessment, but it does not replace a security program, an attorney or your IT provider.
• Who am I talking to? Can you call a person? MyVaultMate is made by CMTechSoftware LLC in Reno-Sparks, Nevada, and the direct line is (775) 229-2579.

How to use this list

Send the six questions to each vendor you are considering, ask for written replies, and compare the specifics. Keep the answers in your vendor file; they help document your due diligence if a client, a regulator or an insurer later asks how you chose the tool. This is general education, not legal advice, and your attorney or advisor can tell you what vendor oversight your obligations require. If you want to test our answers, the sample report shows exactly what comes back, and the security page goes into more detail.