What leaves your machine: a plain-English walkthrough

The first question any careful office manager asks about a tool that reads files is, "Where do my files go?" The honest answer for MyVaultMate is that they do not go anywhere. The scanning happens on your computer, and what travels to the dashboard is a short description of what was found. This article lays out which is which.

What stays on the machine

A small program you run once on each computer keeps running in the background and scans on the schedule you set. It opens files locally, checks them against its detection rules, and moves on. Three things never leave:

• The files themselves. No document, spreadsheet, PDF or email is uploaded.
• The full values. If the agent finds a Social Security number, the number itself is not sent and is not stored. No field for scan results holds a full value.
• The surrounding text. The agent does not ship paragraphs or cells around the finding.

What is sent

For each finding, the agent reports a small record:

1. The file path.
2. The file type.
3. The kind of data (for example, Social Security number, payment card, health information).
4. A severity.
5. The compliance frameworks involved.
6. At most a short redacted sample, such as ***-**-1234, capped at 64 characters.
7. The file's size and date, where in the file the finding is, the label next to the value (such as DOB), and a one-way fingerprint of the file.

Each computer also sends its name, machine ID, operating system, program version and the email of the account that signed it in. If file names include client names, switch on Keep file names off the dashboard and tags are sent instead. This is enough to build the dashboard, rank your risk and produce the exposure report, and nothing in it lets someone reconstruct the underlying data. The reasoning behind the redacted sample is covered in its own article.

File names are information too

Here is a detail that is easy to overlook: a path is sent, and a path can say a lot. A file called Garcia_Maria_2023_Return.pdf in a folder called Clients\Garcia reveals a person's name and that you prepared their return, even though no content was transmitted. File and folder names can contain people's names, diagnoses ("Chen biopsy results"), or employer details.

That is not a flaw to hide; it is a fact to know. It is one reason the data is handled carefully after it arrives, and it is a reason to be thoughtful about naming. If a file name itself is sensitive, tell the people who review the dashboard to treat paths as confidential. Only the people you add to your team can see your dashboard, and our own staff's access is role-gated and logged.

If you would rather the names never leave the computer, switch on Keep file names off the dashboard in Scan settings. Each computer then turns every file and folder name into a tag before anything is sent, for example C:\Users\[user 4f1a]\Desktop\[file 3b9d1a2c].pdf. Common folders such as Desktop and Downloads, and the file type, stay readable so the ranking still works. The tag is made with a key that never leaves the computer, so the dashboard cannot turn it back into a name, and the program on that computer can find the real file for you.

How it travels and where it rests

The report is sent to the dashboard over TLS, the same encryption that protects online banking. The database and its backups are stored encrypted on US-based hosting. These are the details to put in your own records when someone asks how the service handles the data. The security page has the longer description.

You choose what is scanned

The agent scans the usual folders by default plus any drives, synced OneDrive and Google Drive folders, and external or USB disks you add. You choose which drives and folders to include, and you can remove any of them at any time. If a folder holds something you do not want examined, leave it out.

You also choose how often it runs: manual, hourly, daily or weekly. The first scan of a path is a full scan; later ones can be incremental and re-read only the files that changed. The default scan skips AppData and cache locations, and the scan backs off while someone is using the machine.

What the product does not do

It moves or deletes nothing unless you choose to: at the computer, or by an administrator on the dashboard for files its own scans found. For example, you can move the pictures and other files it could not read to one folder, lock a risky file away in its quarantine folder, or mark a file as ignored. It finds exposed data and ranks what to fix; acting on that is up to you or your IT provider. It does not replace a security program, an attorney or an IT provider. And it reads only certain file types: Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg messages. It does not read pictures, videos or recordings, or PDFs that are only a scanned picture of each page: each is listed as “Not scanned” with a risk score of 70. RTF and PowerPoint files, Outlook .pst data files and zip archives are listed the same way.

A quick way to verify for yourself

Do not just take our word for it. Look at the sample report and read the fields. Is there any place where a full value or document text could appear? If you want to dig further, ask us anything on the direct line, (775) 229-2579, and use our checklist, questions an office manager should ask any scanning vendor, with every vendor you consider, including us.