Your first scan: what to expect in the first hour

The first scan is the one people worry about most, and it is usually the least dramatic part of the whole process. You run a small program, it quietly reads files in the background, and results begin to appear in a web dashboard. This article walks through what happens, what is normal, and what to do while you wait.

Before you start

Pick one computer to begin with. Ideally it is the machine that handles the most client paperwork: the front-desk PC, the bookkeeper's laptop, or the shared workstation that everyone uses for scanning documents. Nothing is installed, so you do not need an administrator account: you download one file, run it, and sign in with your account (the same email, password and authenticator code you use on the website). An IT provider can use a one-time pairing code from your dashboard instead.

On Windows, the file is not code-signed yet, so SmartScreen may show a warning the first time you run it. Choose "More info" and then "Run anyway". The details are in the setup guide.

The first few minutes

The download is a single small file, so it is quick. Once you have signed in, the computer appears in your dashboard under its own name. The usual folders are scanned by default, and you can add others. If you are not sure what to pick, start with the folders people actually use rather than the whole disk.

A new organization defaults to hourly incremental scans. That setting matters less on day one, because the very first scan of any path is always a full scan. Every file of a supported type in the chosen locations gets read once.

What the scan is doing

The agent opens files it can read (Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg email messages; it does not read pictures, videos or recordings, or PDFs that are only scanned pictures of each page: those are listed as “Not scanned” with a risk score of 70, and you choose what to do with them) and looks for patterns: Social Security numbers and ITINs, payment card numbers that pass a checksum, driver's license, passport and date-of-birth values that sit next to their labels, medical record numbers, Medicare numbers, health insurance member IDs and provider NPI numbers, and wording that makes a file read like a medical record. It also flags email addresses, phone numbers and IP addresses (at Low severity), and, for GDPR, IBANs, EU and UK national ID numbers and special-category data. The files themselves never leave the computer. What goes to the dashboard is a finding: the file path, the file type, the kind of data, a severity, the compliance frameworks involved, and at most a short redacted sample such as ***-**-1234.

By default the scan skips AppData and cache folders, and the scan runs at a balanced speed: full speed while the computer is idle, fewer files at once while someone is using it or other programs are busy. On a large disk the first scan simply takes longer while the computer is in use.

What you will see, and what is normal

How long a full scan takes depends on how much data is in the chosen locations and how fast the disk is. A small folder of working files finishes quickly; a whole drive full of years of documents takes longer. You do not need to watch it. Findings show up in the dashboard as they are reported, ranked from Critical to Low.

Some things that are normal on a first scan:

• More findings than you expected. Old tax organizers, saved email attachments and exported spreadsheets pile up over the years. A first scan is meant to surface exactly that.
• A few false alarms. Detection is rule-based. A long number in a spreadsheet can look like a card number. The Luhn check cuts down on this, but occasional false alarms still happen.
• Files that were not read. Pictures, videos, recordings and scanned PDFs that are only pictures of the pages are not read, and neither are RTF and PowerPoint files, Outlook .pst data files or zip archives. They appear on the scan's Not scanned list in the dashboard with a risk score of 70, so you can check them by hand, move or quarantine them, or mark them as ignored.
• Health findings are broad. The health keyword signal says a file reads like a medical record. It does not identify individual records; medical record numbers, Medicare numbers and member IDs are reported separately.

What to do with the first results

Resist the urge to fix everything at once. Spend the first hour on three things.

1. Open the highest-severity findings and confirm they are real. Reading a finding explains each field; after that, each finding takes about a minute to check.
2. Look at the by-computer and by-data-type views to see where exposure is concentrated. Often a handful of folders account for most of it.
3. Write down a short action list: which files to move to a secure location, which to delete, and which to hand to your IT provider.

The product moves or deletes nothing on its own. What happens to a file is your choice, made at the computer: for example, after a scan you can move the pictures and other media files it could not read to one folder in one step, or lock a risky file away in its quarantine folder. Both can be undone. Everything else stays with you or your IT provider. After you act, a later scan shows what changed, and the dashboard's totals and risk score update to match, so you can compare them with the report you saved from the first scan.

You can see what a finished report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).