Sensitive data discovery scanner

Phinder

Phinder is a discovery scanner that walks local files and directories to map where sensitive information lives. It's the step that comes before redaction. You can't protect what you can't find.

View on GitHub

Star 2

Point Phinder at a directory. Find every PII entity.

$ java -jar phinder.jar -i records -R

PII found in transcript.txt:
 - 4111 1111 1111 1111 (type: credit-card)
 - sam.taylor@example.net (type: email-address)
 - 123-45-6789 (type: ssn)
Risk Score: 23.75 (MEDIUM)

JSON report generated: report.json
HTML report generated: report.html

Documentation → GitHub →

Find PII across your files

Point Phinder at a directory and it walks every file, classifying the sensitive values inside each one so you know exactly where PII and PHI live before you redact.

$java -jar phinder.jar -i records -R

customers.csv email-address×3phone-number×3
support/transcript.txt email-address×1credit-card×1ssn×1
archive/README.txt no PII found

Sensitive values found in 2 of 3 files, with a risk score for each file and for the whole scan. Findings use the same span types Phileas and Philter report.

Why Phinder

Risk-ranked results

Phinder scores every file for risk, magnitude, and density, and can sort, filter by a minimum risk, and show only the top files, so the riskiest data surfaces first. The directory walk is streamed and log files are read line by line.

Filesystem crawler

Native crawling of local filesystems with support for many document formats. Same policy, same output format, no matter where in your directory tree the files live.

Shared policies with Philter

Phinder reads Phileas policies, the same format Philter uses, and can write a starter policy that enables every entity type a scan found. Phinder bundles its own copy of Phileas, which can be a different version from your Philter, so check a policy in Philter before relying on it.

Audit-ready reports

Every scan writes a JSON report and an HTML report with the entity types and counts per file and in total, plus each file's risk score, and can also record results in MongoDB.

Search-result redaction

Search Redact brings the same Phileas detection to OpenSearch and Elasticsearch, redacting sensitive information from search results before they leave the cluster. Same engine, different surface.

Compounds with the rest of the toolkit

Discovery without redaction is just inventory. Pair Phinder with Philter (to remediate what was found) and Phield (to keep watching what was missed) for a complete PII lifecycle.

Frequently asked questions

If something here isn’t covered, get in touch and we’ll answer.

What is Phinder?

Phinder is a discovery scanner. Point it at a file or directory, including a mounted file share, and it reads the content, detects PII and PHI, and reports which entity types live in which files. It is read-only: the job is to map where sensitive data is, not to change it. Think of it as the inventory step that comes before redaction. You can't protect what you can't find.

How is Phinder different from Philter?

Phinder finds and inventories sensitive data; Philter redacts it. Phinder answers "where is the PII, and what kinds," while Philter acts on it. Both use Phileas policies, and a Phinder scan can write a starter policy for Philter. Phinder bundles its own copy of Phileas, so check a policy in Philter before relying on it.

What storage and file types can Phinder scan?

Phinder crawls local filesystems and reads many document formats. The same policy and the same output format apply across every directory it scans, so reports stay consistent no matter where the files sit.

Does Phinder modify or move my data?

No. Phinder is read-only discovery. It reports the entity types it found per file and in total, and it never redacts, rewrites, or copies your source data anywhere. Remediation is Philter's job; Phinder's job is to tell you what is there and where.

Is Phinder open source?

Yes. Phinder is open source under the permissive Apache License, version 2, and the code is on GitHub. Run it wherever your data lives, with no per-seat fees and no vendor lock-in.

Ready to use Phinder?

Grab the open source and run it yourself, or work with our team directly. Pick the path that fits.

See your options