Prove what personal data you hold — and what you did about it.
Kestryl, powered by the PIIScan engine, discovers PII across structured data, native and scanned PDFs, and images. Confirmed values in structured records are masked in place with ***; in PDFs, scans, and images, PII is identified and located for review. OCR and a locally deployed named-entity recognition model do this without sending sensitive content to an external model service.
The problem
Everyone takes privacy seriously. Few can prove it on demand.
Personal data collects quietly — in enriched leads, support transcripts, scanned forms, images. When a deletion request, an audit, or a regulator's inquiry arrives, sincerity is not a defense. Evidence is. Kestryl is built so the answer to “show me exactly what you searched for and what you masked” is immediate and reproducible, not a reconstruction after the fact.
What it does
One localized detection core across records, PDFs, scans, and images.
A verdict, not a guess
Each candidate is checked against its published validation — mathematical validation for a payment card, country-specific checksum validation for an IBAN. Numbers that cannot exist are never reported as real.
A fingerprint of the rules
The exact rule set reduces to a deterministic signature. Same rules, same signature, any machine — the answer to “what were you searching for, and when.”
A record that can't be rewritten
Every masking action enters a chained log where editing one line breaks the next. The audit trail accrues as the work happens.
Structured records, free text, native PDFs, scanned PDFs, and images flow through one controlled pipeline. OCR extracts text from scanned content, while the locally deployed NER model identifies contextual entities without moving sensitive data outside the deployment environment.
Performance
Built to scan the whole population, not a sample.
The record that surfaces in litigation is the one that was not in the sample. Figures below are measured on a single, modest CPU core; production hardware widens each.
Stated plainly
Structured and native-text scanning sustain these rates comfortably. Optical recognition is bound by page count, not row count — about a fifth of a second per page per core — so its throughput scales with the compute assigned, which we size openly per engagement.
Control
Nothing is masked by accident.
- DefaultFindings are recorded and source data is untouched. Discovery is always safe to run.
- Two keysMasking requires both a configuration setting and a deliberate run-time instruction — turned together, by design. No single hand trips it.
- ReversibleBefore a value is masked with ***, the original is preserved in a controlled quarantine under separate lock. Nothing is destroyed.
- Confidence floorA value must clear a certainty threshold you set before it is ever eligible for masking.
- ScopeMasking applies to structured records. In PDFs, scanned documents, and images, Kestryl identifies and locates PII for review — source documents are never altered.
RULESET SIGNATURE · 09a08673aa6e9ccb · deterministic across environments
Why Pacific Data Integrators
Fifteen years inside the systems your data lives in.
Kestryl comes from a firm with 15+ years and 100+ implementations across Informatica, Salesforce, Snowflake, and Databricks — for banks, insurers, healthcare, government, and retail. It joins PDI's data-quality portfolio on the same conviction: trustworthy data is not a report you produce for an audit, but a property you can prove at any moment.
FAQ
Frequently asked questions
What types of data does Kestryl scan for PII?
Kestryl scans structured records, free text, native PDFs, scanned PDFs, and images through one controlled pipeline. OCR extracts text from scanned content, and a locally deployed NER model identifies contextual entities without sending data to an external service.
Does Kestryl alter source documents during a scan?
No. By default, Kestryl records findings without touching source data. Masking in structured records requires both a configuration setting and a deliberate run-time instruction — two separate steps, by design. PDFs, scanned documents, and images are never altered; Kestryl identifies and locates PII in those formats for review only.
How does Kestryl confirm that a detected value is genuine PII?
Each candidate is checked against its published validation rule — for example, mathematical validation for a payment card number or country-specific checksum validation for an IBAN. Values that fail those checks are never reported as real PII.
Is there an audit trail for Kestryl masking actions?
Every masking action enters a chained log where editing one entry invalidates the next. The audit trail accrues as the work happens and cannot be selectively modified.