Data classification software that leaves your data where it lives

Data classification is knowing what sensitive information you hold, where it sits, and how it must be handled. Myrikeep is a sensitive data discovery and classification product for small and mid-sized businesses, the IT teams and MSPs who look after them, and homelabbers who want to know what is actually on the NAS. A small agent runs inside your network, reads your files and mail, and reports labels, counts and file locations — never contents.

What data classification is

Data classification means assigning every piece of information your business holds a label that says how sensitive it is and therefore how it must be handled. A four-level scheme — Public, Internal, Confidential, Restricted — is the common starting point. The label turns a vague instruction like "be careful with that file" into concrete rules: who may see it, where it may be stored, how long it is kept. Our data classification policy template gives you a four-level scheme you can copy.

Doing that by hand does not scale past a single folder. Classification software automates the finding: detection rules scan file shares, cloud storage and mailboxes for values that are sensitive by their shape — a US Social Security number, a payment card number that passes the Luhn checksum, a private key pasted into a config file. Software cannot write your policy for you, but it shows you exactly where the policy has to apply.

Why small teams skip it — and why that is risky

Classification tools have historically been enterprise projects: months of deployment, agents on every endpoint, matching prices. So small teams often skip the discipline entirely. Folder permissions feel like enough, and everyone trusts everyone.

The risk is quiet accumulation: the payroll spreadsheet from three years ago still on the shared drive, the tax export the NAS sync app copied to the cloud, the API key pasted into a handover document. When something is exposed — a mis-shared link, a stolen laptop, a breached account — the first question is "what exactly was in there?", and without classification nobody can answer it. You cannot protect or delete personal data you have never located.

How Myrikeep classifies your data

Myrikeep runs a small agent — a container you deploy on your own infrastructure, next to the data. Connections are read-only, and scanning never writes to your stores. The console queues jobs; your agent does the reading and all detection. What comes back is the finding: what was detected, how confident the detector is, and where the file is.

Credentials for your sources never reach the console. They live in a local secret file on the agent host, mounted read-only; the console stores only an alias and rejects secrets pasted into connection settings. You can rotate or revoke any agent from the console, and revocation takes effect immediately.

AI is not required. Detection is deterministic local rules. An optional AI assist — off by default, enabled per workspace by an administrator — exists for files the local rules cannot label: when it is on, the agent sends one short snippet with every detected match masked before it leaves. Myrikeep does not write snippet text to its database or logs and never uses your data to train models.

Sources you can scan today: local folders and NFS mounts; SMB file shares, including Windows file servers and Synology, TrueNAS, Unraid and QNAP NAS; Amazon S3 and S3-compatible services such as MinIO, Backblaze B2 and Wasabi; Azure Blob containers; IMAP mailboxes; and personal Google Drive or OneDrive accounts. Microsoft 365 (Exchange mail, OneDrive, SharePoint) and Google Workspace (Gmail, Drive) connectors are marked pilot. Scans run once or on schedules from hourly to monthly, and monitoring policies flag future scans when labeled files pass a threshold you set.

Each store gets a risk score with a published formula, so you can compare and prioritize. Labels export to Microsoft Purview, and every administrative change lands in an append-only audit log.

What Myrikeep detects

The label set covers what small and mid-sized businesses actually hold:

• Identity and finance: US Social Security numbers, payment card numbers (Luhn-validated), bank routing numbers (ABA checksum) and bank account numbers, IBANs, US passport numbers, US driver's license numbers, ITINs, EINs, and dates of birth detected in context.
• Health identifiers: NPI numbers, medical record numbers, and ICD-10 diagnosis codes detected with context.
• Credentials: private keys, AWS access keys and secret keys, GitHub, GitLab, Slack, Stripe and Google API tokens, JWTs, passwords assigned in configuration files, and credentials embedded in URLs.
• Contact and network data: email addresses, IPv4 and IPv6 addresses, MAC addresses.
• Sensitive file types, flagged unread: password vaults such as KeePass databases, certificate keystores (.pfx/.p12), encrypted exports (.gpg/.pgp), and QuickBooks company files and TurboTax returns.

Coverage is explicit rather than assumed. Common text formats, PDF text and modern Office formats get full parsers; other formats receive strings-only checks. Text inside images and scanned PDFs needs OCR, an optional premium feature that runs inside your agent. IMAP mailbox scans read attachments by default, with subject lines as an opt-in, and never message bodies. Every scan reports what was sampled, parsed and skipped on a Coverage page, so "completed" never silently means "everything was read."

Who can see it

For sensitive files, the agent also inspects sharing permissions, read-only, and reports a normalized category with a count: Public, Anyone with link, External, Organization-wide, Broad group, Restricted, or Unknown. You learn that a file is shared with anyone who has the link, not who those people are — names, email addresses and sharing URLs never come back. Unknown is never treated as safe; it stays flagged for review. Age review flags files not modified in 24 months by default.

How to start

1. Try it on your own files. Test Drive scans sample files you upload, with no connector or provider credentials to configure. Files are deleted as soon as the scan finishes; results — file names and labels, never contents — stay available through your private link for 24 hours.
2. Install an agent and connect a source. The getting-started guide covers installing the agent, adding a connection and queueing a first scan on a small, representative scope.
3. Review Findings and Coverage, fix sharing where the exposure signals point, then rescan on a schedule.

Myrikeep is running a founding-customer pilot for small and mid-sized businesses and the IT and MSP teams who look after them: free during the pilot, founding pricing locked for three years, and a direct line to the founders. Request pilot access.

Frequently asked questions

Does Myrikeep see our file contents? No. Reading and classification happen inside the agent on your infrastructure. What comes back is labels, counts, confidence and file locations — never file contents or the matched values.

Where does scanning run? In an agent container you deploy on your own infrastructure, next to the data. The console queues jobs and receives results. The agent container runs read-only with all Linux capabilities dropped.

Which formats are fully parsed? Common text, PDF text and modern Office formats. Other formats get strings-only checks. Images and scanned PDFs need the optional OCR feature, which also runs locally in your agent. Each scan's Coverage page shows what was sampled, parsed and skipped.

Is AI required? No. Detection is deterministic rules running locally, and AI assist is off by default. If an administrator enables it, one short snippet with every match masked is sent, once, for files the local rules could not label. Myrikeep never stores snippet text or uses it for training.

Does Myrikeep block or fix anything? No. It does discovery, classification and exposure signals: it never changes permissions, quarantines or deletes files. It shows you where to act; the change happens in your systems, and you rescan to confirm.

Can we try it before connecting our stores? Yes. Test Drive scans a few uploaded sample files with no connector setup and no provider credentials.