Find the regulated data your inventory missed
GEODI connects to more than 200 systems, reads the text inside scanned documents and images, labels what it finds by sensitivity, then masks or removes the exposure.
- PIPEDA
- Quebec Law 25
- PHIPA
- HIPAA
- CCPA
- GLBA
- SOX
- LFPDPPP
- PCI DSS
Two different sets of questions
A security buyer and a reseller want almost nothing in common. The pages are built separately so neither one gets a half answer.
You are evaluating GEODI
What it finds, which file types it reaches inside, where the server can sit, and how a licence is scoped.
- Discovery across more than 200 connected systems
- Optical character recognition for scanned paper
- Masking and anonymization bound to user groups
- On-premises, your own cloud region, or hosted
You want to resell it
An installed base, a documented feature set, and vendor engineering sitting behind your team.
- Registered deals acknowledged within five business days
- Demo environment and a technical certification path
- You hold first and second line, escalation covers the rest
- Terms agreed partner by partner
Structured data is the part you already track
Every team can name the databases they run. Almost none can name the scanned contract on a share drive with a client account number inside it.
The exposure sits outside the systems anyone inventories. Optical character recognition turns page images into searchable text on the GEODI server, so a card number printed on a 2019 invoice is caught by the same recognizer that finds one sitting in a database column.
Email attachments
Sent once, kept forever, and outside every retention schedule anyone wrote.
Exports nobody deleted
Pulled for a one-off report in 2021 and still sitting on the share it was written to.
Inherited folders
Arrived through a migration or an acquisition, with nobody left who knows what is in them.
Scanned paper
Invisible to anything that searches text alone, until OCR brings it into the same index.
Five capabilities a reviewer will ask about
Five capabilities, each one answering a question a reviewer will put to you.
Where is the regulated data
Point GEODI at a source with read access and it indexes the content rather than the file names. Prebuilt recognizers catch payment cards from nine networks, financial fields, currency values and national identifier formats across the three markets.
- Sources
- 200+ adapters
- Scanned paper
- OCR, run on your server
- Attachments opened as content
- Databases
- Sampling by record count
- Scan access
- Read only
How sensitive is each finding
Four classes arrive configured and stay editable. Each carries an identifier, a description and a query that decides what falls into it, so a document landing in a class can be explained to a privacy officer rather than asserted.
- Confidential
- Financial or commercial documents and sensitive material
- PII
- Two or more pieces of personal information together
- Restricted
- Commercial data held under tighter control
- Unclassified
- Content matching none of the above
Who gets to see the real values
Masking binds to the user group rather than the document, so one record reads three different ways depending on who opened it. An analyst can work a dataset without the originals ever rendering on their screen.
- Administrator
- No masking, original values
- ViewOnlyAccess
- Mask All, placeholders
- FullDictionaryAccess
- Anonymize All, substitutes
- Applied at
- Display time, per group
Can read-only stay read-only
Group permissions govern project creation, dictionary edits, permission management and system administration as a grid. A group without edit rights cannot reach an edit path through a side door.
- Indexing
- Read only
- Classification
- Read only
- Remediation
- Separate switch, per source
- Credentials
- Yours, scoped and revocable
What do you hand the auditor
Evidence is generated from the index at the moment of asking rather than assembled in the week before a review. Every action that changes something writes a record naming the account, the target and the time.
- Inventory
- Which systems hold regulated data, by category
- Classification
- How each item was labelled and under which rule
- Access
- Who could reach sensitive content at a point in time
- Actions
- What was masked, moved or removed, by which account
Discovery on its own produces a list
Most scanners stop at the point where the work actually starts. Here is what that leaves on your desk.
Connect
Point GEODI at a source with read access. Folders, mail, databases, cloud storage and collaboration tools.
Recognize
Prebuilt recognizers detect card numbers, national identifiers, health numbers and financial values.
Classify
Findings are labelled Confidential, PII, Restricted or Unclassified against rules you control.
Mask
Values are masked or anonymized per user group, so analysts work without seeing originals.
Govern
Permissions decide who sees what, and every change is attributable to an account.
Anonymization, run on real records
One query, run twice against the same PCI DSS project. The second run applies the anonymize profile, so card numbers and financial values are swapped for realistic substitutes. The dataset keeps its shape for testing and the originals stay protected.
Server location decides your jurisdiction
Data residency stops being a promise a vendor makes and becomes a fact about where you put the machine.
Your own servers
The index sits inside infrastructure you already control, and discovery needs no outbound connection.
A cloud region you choose
Runs inside your own tenancy, in the region your policy names, operated by your team.
Hosted for you
Operated on your behalf, with the region confirmed by contract rather than by your own topology.
One product against ten regulations
Every regime opens with the same two questions, which are what personal data you hold and who can reach it.
| Market | Rules that drive the work | What GEODI contributes |
|---|---|---|
| Canada | PIPEDA, Quebec Law 25, PHIPA, FIPPA and MFIPPA | Inventory of personal data, access requests answered from the index, anonymization for retention limits |
| United States | HIPAA, CCPA and CPRA, GLBA, SOX, state privacy statutes | Protected health and financial data located, access restricted, audit evidence produced on request |
| Mexico | LFPDPPP | Personal data identified across holdings, masking applied, controls documented |
| Cross-border | PCI DSS, GDPR where it applies | Cardholder data discovery, assessment scope reduction, subject access response |
GEODI performs these functions against data in scope. Certification of your organization stays the outcome of your own program.
Does our data leave the network
Discovery, indexing, optical character recognition and classification all run on the GEODI server. The AI question answering path sends the prompt and retrieved context to a language model, and never the source documents. Where policy forbids any external call, that model can be self hosted so nothing leaves at all.
Can a scan change or delete our files
Not by itself. Discovery runs read only. Remediation is a separate switch turned on per source with credentials you supply and can revoke, and every action it takes is recorded against an account.
Can it read scanned paper
Yes. Optical character recognition is enabled per project, which brings scanned PDFs, images and archived paper into the same search as native text. This is usually where the surprises are.
Does it make us compliant
No, and treat any vendor claiming otherwise with suspicion. It supplies the inventory, the labels, the controls over sensitive content and the audit record. Lawful basis, retention policy, training and certification stay with your program.
What does it cost
Licensing is a subscription priced against data volume, source count, the capabilities you need and the deployment model. Quotes are built per environment after a scoping conversation.
Run it against one of your own systems
A scoped session on representative data tells you more than any specification sheet. We connect one source, run discovery, and walk through what surfaced.