---
title: Sensitive Info
description: A live map of where regulated data actually lives - every sensitive information type traced to the files, emails, sites, groups, users, and apps that can reach it.
icon: Fingerprint
---

# Sensitive Info

The Sensitive Info screen answers the question every auditor asks and almost no one can answer: **"Where is our regulated data right now - and who can reach it?"** Credit card numbers, national IDs, health records, credentials - each detected type becomes one row, mapped across your entire estate: how many files and emails contain it, which sites concentrate it, and which users, groups, and apps can get to it.

## What You Can Achieve

<Cards>
  <Card
    title="Map regulated data across the estate"
    description="One row per sensitive information type, with live counts of the files, emails, sites, groups, users, and apps it touches. The distribution map a compliance audit normally takes weeks to approximate."
  />
  <Card
    title="Detect without Purview - or verify it"
    description="1Security runs its own scanning engine with 300+ detectors plus OCR, and separately syncs Microsoft Purview detections. Full coverage without premium licensing - and an independent check when you have it."
  />
  <Card
    title="Scope audits by framework"
    description="Filter detections by compliance framework - GDPR, HIPAA, PCI-DSS, SOX, CCPA, FERPA - and hand each auditor a view scoped to exactly the data their regulation covers."
  />
  <Card
    title="Answer breach-scope questions in minutes"
    description="A site was exposed, an account compromised. Filter sensitive info to that site or user and you have the regulated-data blast radius for the disclosure decision - with confidence levels attached."
  />
</Cards>

## Two Engines, One Truth

Detections carry their provenance, and the two sources are deliberately independent:

- **Microsoft Purview sync** - 1Security imports the Sensitive Information Type detections Microsoft has already made, so existing Purview investment shows up here immediately.
- **1Security scan** - our own engine reads file and email content and applies 300+ detectors, including OCR for scanned documents and images - the place card numbers actually hide. It runs without E5 licensing. See [Sensitivity Scanning](/en/docs/sensitivity).

The two engines synergize rather than compete: existing Purview investment shows up immediately and gets an independent verification, while 1Security's own engine covers tenants - and file types - Purview doesn't. Remediation stays where it belongs: DLP and auto-labeling policies are configured in Purview, aimed by what you find here.

Every detection includes a **confidence level** (high / medium / low), so you can quote regulator-grade numbers from high-confidence matches while still investigating the long tail.

## The Detection List

Each row is a sensitive information type with its active status, confidence level, and reach counts across **files**, **emails**, **sites**, **groups**, **users**, and **apps**. Those counts are the pivot points: they tell you not just that 4,120 files contain IBAN numbers, but that they concentrate in two sites and are reachable by three third-party apps.

Filters scope the view to specific users, groups, sites, files, or apps, compliance frameworks, label associations, and orphaned resources - so "sensitive data reachable by X" is a filter, not a project.

## Investigative Patterns

<Callout type="info">
  **Third-party reach into regulated data**: filter framework **GDPR** and sort
  by the **apps** column. Every app that can read personal data is a
  data-processing relationship your DPO should know about - most organizations
  discover several here they never documented.
</Callout>

- **Concentration analysis** - pick your highest-risk type (payment cards, health data) and check the **sites** count: two sites holding 90% of it means two remediation projects, not two hundred.
- **Regulator-grade numbers** - filter **high confidence** only when preparing disclosure or audit figures; keep lower confidence matches as your investigation backlog.
- **From detection to exposure** - from any type, pivot to the [Files screen](/en/docs/screens/files) and combine it with sharing filters to see which instances of that data are public, external, or unlabeled.