What a MyVaultMate report contains, section by section

The MyVaultMate exposure report is a branded PDF built from your dashboard data. It is designed so that an owner can read the first page in a minute and a manager can use the rest as a work list. Here is what each section contains and how to read it. You can also see a finished one at /sample.

Page 1: the page for your insurance broker

Every report opens with a page you can send to your insurance broker, on every plan. It says “Safe to share with your insurance broker” at the top and has no file names, folder paths, people's names or sample values. It shows:

• The three average risk scores. Every file gets a risk score from 0 to 100. Each average is the total of those scores divided by the number of files: one for all files, one for the files MyVaultMate could read, and one for the files where it found something. Each comes with the number of files behind it and a band (Low, Medium, High or Critical).
• What was found: counts by kind of data, and how many files hold each.
• Files it could not read. MyVaultMate reads text files and other files it can open. It does not read pictures, videos or recordings: they're listed with a risk score of 70, and you choose what to do with them. The page counts them and says how many were quarantined, moved, deleted or marked as ignored.
• The trend: new and fixed findings over the period.
• Controls in place, from facts the dashboard knows: two-factor sign-in, disk encryption on each computer, each computer's scan schedule and last scan, how many computers the plan covers, and what sits in the encrypted quarantine and vault. Computers are numbered, not named.

A worked example of the averages: a computer with 18 files where nothing was found (a small score of 5 each, for where they sit), one Social Security number in Documents, one on the Desktop, and 5 pictures (70 each). The all-files average divides the total of all 25 scores by 25; the readable-files average divides the 20 readable files' total by 20; the files-with-findings average divides the two spreadsheets' total by 2. Moving the Desktop spreadsheet into Documents, or deleting it, lowers every average. How the score works has the exact numbers.

The internal pages: the five headline numbers

Everything after page 1 is marked “Internal: for fixing files, don’t forward”, because it lists file paths and masked samples. The first internal page shows five figures:

1. Files scanned. How many files the scan covered across the paths you chose. This is context: it tells you how much ground was covered.
2. Files with exposed data. How many of those files contained at least one finding. Compare it to files scanned to see how concentrated the problem is.
3. High severity. The number of findings in the top severity levels. If you only have time to look at one number, look at this one.
4. Devices affected. How many of your computers hold at least one finding, out of how many were scanned.
5. ID numbers found (an estimate). A rough count of the different Social Security, card, passport and driver's license numbers found.

The last number needs care. It is an estimate, not a head count of people. It is counted from the redacted samples, which show only the last few characters, so two different numbers can look the same, the same person can appear under more than one kind of ID, and some values may be false alarms. Use it to get a sense of scale. Do not use it as a figure in a legal notice or as an exact count of affected individuals. If you ever have a real incident, an attorney can advise on how to determine who was involved.

Findings by data type

This section breaks findings down by the kind of data: Social Security numbers and ITINs, payment cards, driver's license, passport and date-of-birth values, health ID numbers (medical record numbers, Medicare numbers, insurance member IDs, provider NPIs), health information, contact details (email addresses, phone numbers and IP addresses) and, for GDPR, IBANs, EU and UK ID numbers and special-category data. It tells you which kinds of exposure dominate. A tax office may see mostly Social Security numbers. A law firm handling injury or benefits cases may also see health ID numbers and health signals, which are a keyword indication that a file reads like a medical record rather than a list of identified records.

This view helps you choose the right response. Card numbers, for example, point toward the card-industry standard (PCI DSS) and the simplest path of not storing card numbers at all, while health findings may raise health-privacy questions; HIPAA applies only to some organizations, so ask your attorney whether it applies to you.

Findings by computer

This section shows how findings spread across your machines. In many offices a few computers hold most of the exposure: the front desk, the machine attached to the scanner, or the workstation that has been in use the longest. Knowing this lets you plan clean-up by machine instead of by file.

Highest-risk files

Here the report lists the files that deserve attention first. Each entry shows the file path, the file type, the kind of data and the severity, with only a short redacted sample such as ***-**-1234. The full values are never in the report, because the product never stores them. Treat the list as your first hour of work: open each file, confirm it is real, and decide whether it should be moved, protected or deleted. Reading a finding explains the fields in detail.

Next steps

The closing section turns the data into actions. It is a starting point for a conversation with your team and your IT provider. MyVaultMate moves or deletes nothing on its own, so the steps are yours to carry out. A simple way to use the section is to assign each step an owner and a date, and then re-scan.

Using the report over time

The first report is a baseline. After you clean up, later scans show progress, and the dashboard totals fall to match. Keep your first report and compare it with the latest. Many offices keep each report as a record of what they reviewed and when. That can help support the documentation you may need for a written security program or a risk analysis, but a report does not by itself make anyone compliant, and an attorney or advisor can tell you what your rules require.

Besides the PDF, the dashboard exports to CSV and XLSX, which is handy if you want to filter findings in a spreadsheet or hand them to your IT provider.

What the report cannot show

Reports reflect only the paths you scanned and the files the agent can read. Files it cannot read (pictures, videos, recordings, scanned PDFs that are only pictures of the pages, RTF, PowerPoint, Outlook .pst, zip archives, password-protected or damaged files) are listed as “Not scanned” with a risk score of 70, never as clean. Detection is rule-based, so occasional false alarms happen. Keeping those limits in mind will help you read the numbers sensibly.