{
  "schema": 1,
  "program": {
    "name": "MyVaultMate",
    "version": "2.3.2",
    "mode": "user"
  },
  "computer": {
    "machine_id": "87bf65dc41564feda7c5b1bba1a2261e",
    "hostname": "FRONT-DESK-2",
    "os": "Ubuntu 24.04.5 LTS",
    "os_family": "linux",
    "architecture": "x86_64",
    "disk_encryption": "off",
    "kernel": "6.8.0-147-generic",
    "platform": "linux",
    "os_version": "Ubuntu 24.04.5 LTS",
    "device_id": "5f0c2a9e-3b71-4c7e-9a52-0d1f6a8e4b13"
  },
  "connection": {
    "server": "https://cmtechsoftware.io",
    "paired": true,
    "paired_at": "2026-11-03T09:05:21-08:00",
    "paired_via": "account sign-in",
    "signed_in_as": "owner@example-dental.test"
  },
  "account": {
    "organization": "Example Dental",
    "plan": "Practice",
    "status": "trialing",
    "active": true,
    "trial": true,
    "trial_days_left": 11,
    "computers_allowed": 30,
    "computers_used": 4,
    "locations_allowed": 3,
    "locations_used": 1
  },
  "dashboard_settings": {
    "enabled": true,
    "license_valid": true,
    "plan": "Practice",
    "schedule": "daily",
    "scan_time": "22:00",
    "scan_window": {
      "name": "Overnight (day-shift office)",
      "days": [
        0,
        1,
        2,
        3,
        4,
        5,
        6
      ],
      "start": "22:00",
      "end": "05:00"
    },
    "extraction": {
      "doc_unit": "pages",
      "doc_pages": 3,
      "doc_words": 1000,
      "media_seconds": 30,
      "early_exit": true
    },
    "paths": [
      "/home/office/Documents"
    ],
    "incremental": true,
    "throttle": "off",
    "file_types": [
      "pdf",
      "word",
      "rtf",
      "text",
      "excel",
      "csv",
      "image_jpg"
    ],
    "excluded_paths": [],
    "retention": {
      "log_days": 30,
      "report_days": 30
    },
    "report_action": "manual",
    "poll_seconds": 20
  },
  "scan_folders": {
    "default_folders": {
      "note": "What this system scans when nobody has chosen folders. Only folders that exist and are readable are used.",
      "folders": [
        {
          "path": "/home/office/Documents",
          "exists": true,
          "readable": true
        },
        {
          "path": "/srv",
          "exists": true,
          "readable": true
        },
        {
          "path": "/mnt",
          "exists": true,
          "readable": true
        },
        {
          "path": "/media",
          "exists": true,
          "readable": true
        },
        {
          "path": "/home/cmtechsoftware",
          "exists": true,
          "readable": true
        },
        {
          "path": "/home/myvaultmate",
          "exists": true,
          "readable": true
        },
        {
          "path": "/home/skillvaultai",
          "exists": true,
          "readable": true
        }
      ]
    },
    "dashboard": {
      "uses_default_folders": false,
      "folders": [
        "/home/office/Documents"
      ],
      "replaces_defaults": true,
      "excluded_folders": [],
      "excluded_extensions": []
    },
    "added_on_this_computer": [
      {
        "path": "/home/office/Documents",
        "exists": true,
        "readable": true
      }
    ],
    "scanning_now": [
      {
        "path": "/home/office/Documents",
        "exists": true,
        "readable": true
      }
    ],
    "history": [
      {
        "at": "2026-11-03T09:05:21-08:00",
        "change": "added",
        "folder": "/home/office/Documents",
        "by": "this computer"
      }
    ]
  },
  "file_types": {
    "scanned": [
      "pdf",
      "word",
      "rtf",
      "text",
      "excel",
      "csv",
      "image_jpg"
    ],
    "extra_types_from_dashboard": [],
    "excluded_extensions": []
  },
  "detection": {
    "note": "What the scan looks for and the algorithm for each. PII, PHI, HIPAA and GDPR are the frameworks a finding counts toward. Findings carry only the masked sample, never the value.",
    "detectors": [
      {
        "id": "ssn",
        "name": "Social Security numbers",
        "enabled": true,
        "method": "pattern",
        "algorithm": "Nine digits written 3-2-4 with dashes (the 000-00-0000 layout), with impossible numbers rejected (area 000, 666, group 00, serial 0000). Taxpayer ID (ITIN) numbers in the same dashed format. Nine digits with or without dashes or spaces when they sit right after a label such as \"SSN\" or \"Social Security number\".",
        "patterns": [
          {
            "what": "dashed SSN (3-2-4, impossible numbers rejected)",
            "regex": "\\b(?!000|666|9\\d\\d)\\d{3}-(?!00)\\d{2}-(?!0000)\\d{4}\\b",
            "flags": "none"
          },
          {
            "what": "ITIN (9xx-NN-xxxx, valid middle groups)",
            "regex": "\\b9\\d{2}-(?:5\\d|6[0-5]|7\\d|8[0-8]|9[0-2]|9[4-9])-\\d{4}\\b",
            "flags": "none"
          },
          {
            "what": "nine digits right after an SSN / Social Security label",
            "regex": "(?:\\bssn\\b|\\bsocial\\s+security(?:\\s+(?:number|no\\.?|#))?)\\W{0,25}(\\d{3}[ -]?\\d{2}[ -]?\\d{4})\\b",
            "flags": "ignorecase"
          }
        ],
        "validators": [
          "area not 000, 666 or 9xx (except ITIN); group not 00; serial not 0000"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [
          {
            "what": "part / item / order codes just before the number",
            "regex": "\\b(?:sku|part|item|model|project|code|ref|order|invoice|tracking|lot|batch|po|pn|serial|asset)\\b[\\s#:.no]{0,6}$"
          }
        ],
        "severity": "critical",
        "default_severity": "critical",
        "frameworks": [
          "PII",
          "HIPAA",
          "GDPR"
        ],
        "stored_sample": "*****0000",
        "source": "built in"
      },
      {
        "id": "card",
        "name": "Payment card numbers",
        "enabled": true,
        "method": "pattern",
        "algorithm": "Numbers of 13 to 19 digits (spaces or dashes allowed) that pass the Luhn check, the checksum every real card number satisfies. Random long numbers usually fail it and are ignored.",
        "patterns": [
          {
            "what": "13-19 digits in one run, or 4-4-4-4 / 4-6-5 groups",
            "regex": "(?<![\\d-])(?:\\d{4}[ -]\\d{4}[ -]\\d{4}[ -]\\d{1,7}|\\d{4}[ -]\\d{6}[ -]\\d{4,5}|\\d{13,19})(?![\\d-])",
            "flags": "none"
          }
        ],
        "validators": [
          "Luhn checksum must pass"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "critical",
        "default_severity": "critical",
        "frameworks": [
          "PII",
          "PCI",
          "GDPR"
        ],
        "stored_sample": "************0000",
        "source": "built in"
      },
      {
        "id": "health",
        "name": "Health information",
        "enabled": true,
        "method": "signal",
        "algorithm": "A keyword signal about the whole file, not individual records: one strong term (diagnosis, prescription, medical record, MRN, ICD-10, PHI) or at least two different weaker terms (patient, treatment, symptom, physician, blood type) mentioned three or more times in total. Whole words only. It says the file reads like medical information; it does not extract or store anything from it.",
        "patterns": [
          {
            "what": "strong health terms",
            "regex": "\\b(?:diagnos[ie]s|icd-?10|medical\\s+records?|mrn|prescriptions?|protected\\s+health\\s+information)\\b",
            "flags": "ignorecase"
          },
          {
            "what": "the term PHI (case-sensitive)",
            "regex": "\\bPHI\\b",
            "flags": "none"
          },
          {
            "what": "weaker health terms",
            "regex": "\\b(?:patients?|treatments?|symptoms?|physicians?|blood\\s+type)\\b",
            "flags": "ignorecase"
          }
        ],
        "validators": [
          "one strong term, or at least two different weaker terms mentioned 3 or more times in total"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "high",
        "default_severity": "high",
        "frameworks": [
          "PII",
          "HIPAA",
          "GDPR",
          "PHI"
        ],
        "stored_sample": "(no sample is stored)",
        "source": "built in"
      },
      {
        "id": "passport",
        "name": "Passport numbers",
        "enabled": true,
        "method": "label",
        "algorithm": "A 6-9 character letters-and-digits value (with at least one digit) right after the word \"passport\". A bare label with no value, such as a blank form field, is not a finding.",
        "patterns": [
          {
            "what": "6-9 letters/digits with at least one digit",
            "regex": "\\b(?=[A-Z0-9]*\\d)[A-Z0-9]{6,9}\\b",
            "flags": "ignorecase"
          }
        ],
        "validators": [],
        "must_follow_label": "\\bpassport\\b",
        "label_window_chars": 40,
        "ignored_when": [],
        "severity": "high",
        "default_severity": "high",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "*****0000",
        "source": "built in"
      },
      {
        "id": "national_id",
        "name": "Driver's license and national ID numbers",
        "enabled": true,
        "method": "label",
        "algorithm": "A value of 6-18 letters, digits or dashes (at least four of them digits) right after \"driver's license\", \"DL no.\", \"DLN\" or \"national ID\". A bare label with no value is not a finding.",
        "patterns": [
          {
            "what": "driver's license / national ID label followed by a 6-18 character value",
            "regex": "(?:\\bdriver'?s?\\s+licen[sc]e|\\bdl\\s*(?:no\\.?|#|number)|\\bdln\\b|\\bnational\\s+id(?:entity)?(?:\\s+number)?)\\W{0,15}(?:(?:number|no\\.?|#)\\W{0,10})?([A-Z0-9][A-Z0-9-]{5,17})",
            "flags": "ignorecase"
          }
        ],
        "validators": [
          "at least four digits in the value"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "high",
        "default_severity": "high",
        "frameworks": [
          "PII",
          "HIPAA",
          "GDPR"
        ],
        "stored_sample": "*******0000",
        "source": "built in"
      },
      {
        "id": "dob",
        "name": "Dates of birth",
        "enabled": true,
        "method": "label",
        "algorithm": "A date (such as 01/31/1990) within a few words after a label like \"DOB\", \"date of birth\", \"birth date\" or \"born on\". A date with no birth label is not a finding.",
        "patterns": [
          {
            "what": "a date (m/d/yy, m-d-yyyy)",
            "regex": "\\b\\d{1,2}[/-]\\d{1,2}[/-]\\d{2,4}\\b",
            "flags": "none"
          }
        ],
        "validators": [],
        "must_follow_label": "\\b(?:dob|d\\.o\\.b\\.?|date\\s+of\\s+birth|birth\\s?date|born\\s+on)\\b",
        "label_window_chars": 60,
        "ignored_when": [],
        "severity": "medium",
        "default_severity": "medium",
        "frameworks": [
          "PII",
          "HIPAA",
          "GDPR"
        ],
        "stored_sample": "******1990",
        "source": "built in"
      },
      {
        "id": "phone",
        "name": "Phone numbers",
        "enabled": true,
        "method": "pattern",
        "algorithm": "10-digit North American numbers, with or without +1, parentheses, dashes, dots or spaces.",
        "patterns": [
          {
            "what": "10-digit North American number",
            "regex": "\\b(?:\\+?1[-.\\s]?)?\\(?\\d{3}\\)?[-.\\s]?\\d{3}[-.\\s]?\\d{4}\\b",
            "flags": "none"
          }
        ],
        "validators": [],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "low",
        "default_severity": "low",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "******0000",
        "source": "built in"
      },
      {
        "id": "email",
        "name": "Email addresses",
        "enabled": true,
        "method": "pattern",
        "algorithm": "Standard name@domain.tld addresses.",
        "patterns": [
          {
            "what": "name@domain.tld",
            "regex": "\\b[A-Za-z0-9._%+\\-]+@[A-Za-z0-9.\\-]+\\.[A-Za-z]{2,}\\b",
            "flags": "none"
          }
        ],
        "validators": [],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "low",
        "default_severity": "low",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "****.com",
        "source": "built in"
      },
      {
        "id": "ip_address",
        "name": "IP addresses",
        "enabled": true,
        "method": "pattern",
        "algorithm": "IPv4 addresses (four numbers from 0 to 255 separated by dots).",
        "patterns": [
          {
            "what": "IPv4 address",
            "regex": "\\b(?:(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)\\b",
            "flags": "none"
          }
        ],
        "validators": [],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "low",
        "default_severity": "low",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "*******.0.1",
        "source": "built in"
      },
      {
        "id": "iban",
        "name": "Bank account numbers (IBAN)",
        "enabled": true,
        "method": "pattern",
        "algorithm": "International Bank Account Numbers (two letters for the country, two check digits, then the account, with or without spaces), checked with the IBAN checksum (mod 97) and the length each country uses, so random codes are ignored.",
        "patterns": [
          {
            "what": "country code, 2 check digits, then the account",
            "regex": "\\b([A-Z]{2}\\d{2}(?:[ ]?[A-Z0-9]){11,30})\\b",
            "flags": "none"
          }
        ],
        "validators": [
          "IBAN checksum (mod 97 = 1)",
          "the length that country uses"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "high",
        "default_severity": "high",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "****************0000",
        "source": "built in"
      },
      {
        "id": "eu_national_id",
        "name": "EU and UK national ID numbers",
        "enabled": true,
        "method": "pattern",
        "algorithm": "UK National Insurance numbers (AB123456C, with the letter rules HMRC uses), Spanish DNI and NIE numbers (checked with their control letter), Italian codice fiscale (checked with its control character), French social security numbers (NIR, checked with their 2-digit key), and, next to their label, Dutch BSN numbers (eleven test) and German tax ID numbers (Steuer-ID, check digit).",
        "patterns": [
          {
            "what": "UK National Insurance number",
            "regex": "\\b([A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z])[ ]?(\\d{2})[ ]?(\\d{2})[ ]?(\\d{2})[ ]?([A-D])\\b",
            "flags": "none"
          },
          {
            "what": "Spanish DNI",
            "regex": "\\b(\\d{8})[- ]?([A-Z])\\b",
            "flags": "none"
          },
          {
            "what": "Spanish NIE",
            "regex": "\\b([XYZ])[- ]?(\\d{7})[- ]?([A-Z])\\b",
            "flags": "none"
          },
          {
            "what": "Italian codice fiscale",
            "regex": "\\b([A-Z]{6}\\d{2}[A-EHLMPRST]\\d{2}[A-Z]\\d{3}[A-Z])\\b",
            "flags": "none"
          },
          {
            "what": "French NIR",
            "regex": "\\b([12])[ ]?(\\d{2})[ ]?(0[1-9]|1[0-2]|[2-9]\\d)[ ]?(\\d{2}|2[AB])[ ]?(\\d{3})[ ]?(\\d{3})[ ]?(\\d{2})\\b",
            "flags": "none"
          },
          {
            "what": "Dutch BSN (after its label)",
            "regex": "\\b(\\d{9})\\b",
            "flags": "none"
          },
          {
            "what": "German Steuer-ID (after its label)",
            "regex": "\\b(\\d{2})[ ]?(\\d{3})[ ]?(\\d{3})[ ]?(\\d{3})\\b",
            "flags": "none"
          }
        ],
        "validators": [
          "HMRC prefix and suffix rules",
          "DNI/NIE control letter",
          "codice fiscale control character",
          "NIR 2-digit key",
          "BSN eleven test",
          "Steuer-ID check digit"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "high",
        "default_severity": "high",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "*****000A",
        "source": "built in"
      },
      {
        "id": "gdpr_special",
        "name": "GDPR special-category data",
        "enabled": true,
        "method": "signal",
        "algorithm": "Files that record Article 9 data about a person: religion or belief, racial or ethnic origin, political opinions, trade union membership, sexual orientation, or genetic data, written as a field (\"Religion:\", \"Ethnic origin:\") or mentioned more than once. A signal about the file, like health information.",
        "patterns": [
          {
            "what": "an Article 9 field such as Religion: or Ethnic origin:",
            "regex": "\\b(?:religion|religious\\s+(?:affiliation|belief)|denomination|ethnic(?:ity|\\s+origin)|racial\\s+origin|race|political\\s+(?:party|affiliation|opinions?|views?)|trade\\s+union(?:\\s+member(?:ship)?)?|union\\s+membership|sexual\\s+orientation|genetic\\s+(?:data|test(?:ing)?|results?|markers?)|genotype|dna\\s+(?:test|results?))\\s*:",
            "flags": "ignorecase"
          },
          {
            "what": "Article 9 terms",
            "regex": "\\b(?:religious\\s+(?:affiliation|belief)|ethnic\\s+origin|racial\\s+origin|political\\s+(?:affiliation|opinions?)|trade\\s+union\\s+member(?:ship)?|sexual\\s+orientation|genetic\\s+(?:data|testing|test\\s+results?)|genotype)\\b",
            "flags": "ignorecase"
          }
        ],
        "validators": [
          "a field, or at least two mentions"
        ],
        "must_follow_label": null,
        "label_window_chars": null,
        "ignored_when": [],
        "severity": "high",
        "default_severity": "high",
        "frameworks": [
          "PII",
          "GDPR"
        ],
        "stored_sample": "(no sample is stored)",
        "source": "built in"
      }
    ],
    "rules_changed_from_default": false,
    "frameworks": {
      "PII": [
        "ssn",
        "card",
        "dob",
        "phone",
        "email",
        "health",
        "national_id",
        "passport",
        "biometric",
        "ip_address",
        "iban",
        "eu_national_id",
        "gdpr_special",
        "unscanned",
        "other"
      ],
      "PHI": [
        "health"
      ],
      "HIPAA": [
        "ssn",
        "dob",
        "health",
        "national_id",
        "biometric"
      ],
      "GDPR": [
        "ssn",
        "card",
        "dob",
        "phone",
        "email",
        "health",
        "national_id",
        "passport",
        "biometric",
        "ip_address",
        "iban",
        "eu_national_id",
        "gdpr_special"
      ],
      "PCI": [
        "card"
      ]
    },
    "sample_max_chars": 64
  },
  "scoring": {
    "model": {
      "severity_weights": {
        "low": 1.0,
        "medium": 4.0,
        "high": 8.0,
        "critical": 16.0
      },
      "scale": 10.0,
      "bands": [
        [
          75,
          "Critical"
        ],
        [
          50,
          "High"
        ],
        [
          25,
          "Medium"
        ],
        [
          1,
          "Low"
        ]
      ],
      "formula": "score = round(100 * (1 - exp(-total_weight / scale))), total_weight = sum of the severity weights"
    },
    "frameworks_scored": [
      "pii",
      "phi",
      "hipaa",
      "gdpr",
      "pci"
    ],
    "exposure_weighting": {
      "location": {
        "exposed": 1.5,
        "practice_software": 0.75,
        "other": 1.0,
        "exposed_folders": [
          "desktop",
          "downloads",
          "download",
          "temp",
          "tmp",
          "$recycle.bin",
          "recycle.bin",
          "recycler",
          ".trash",
          "trash",
          "public",
          "shared",
          "share",
          "onedrive",
          "dropbox",
          "google drive",
          "googledrive",
          "my drive",
          "icloud drive",
          "iclouddrive",
          "box",
          "box sync"
        ]
      },
      "older_than_days": 730,
      "older_factor": 1.25,
      "disk_encrypted_factor": 0.75
    },
    "this_disk_encrypted": "off",
    "coverage_gap": {
      "not_in_risk_score": true,
      "each_unread_file": 70,
      "band": "Medium"
    },
    "last_scan": null
  },
  "scans": {
    "last_scan_at": null
  },
  "files": {
    "Mode": "user (signed-in account)",
    "Program": "/home/office/.local/bin/myvaultmate",
    "Config (server, device id, token)": "/home/office/.config/myvaultmate/config.json",
    "All settings, connection, account, machine ID (JSON)": "/home/office/.config/myvaultmate/settings.json",
    "Incremental manifest": "/home/office/.local/share/myvaultmate/manifest.db",
    "Logs (rotating, 14 days)": "/home/office/.local/share/myvaultmate/logs/agent.log",
    "Local reports (last 25 scans)": "/home/office/.local/share/myvaultmate/reports/scan-YYYYMMDD-HHMMSS.html + .json + .csv + .pdf",
    "Runtime: single instance": "/run/myvaultmate.lock",
    "Runtime: control socket": "/run/myvaultmate.sock",
    "Autostart": "/home/office/.config/systemd/user/myvaultmate.service",
    "Autostart fallbacks": "~/.config/autostart/myvaultmate.desktop, then cron @reboot"
  },
  "not_stored_here": "The device token is kept encrypted in config.json and is never written to this file. The account password is never stored anywhere.",
  "generated_at": "2026-11-03T09:05:21-08:00"
}