The Evidence Standard
Most tools can find personal data. Under active GDPR or CCPA scrutiny, the harder question is proving exactly what you searched for, what you found, and what you did about it — on any given day, to anyone who asks.
01 The stakes have moved
A decade ago, personal data was an operational concern owned by IT. Today it sits on the balance sheet of trust. A single mishandled record is a headline; a pattern of them is a consent decree. For a consumer brand, the cost of a privacy failure is rarely the fine. It is the erosion of the one thing that took years to earn and moments to lose.
The marketing organization now depends on data it does not fully control: leads enriched from a dozen sources, support transcripts thick with unstructured detail, scanned documents, forms, images. Each is a place personal data collects quietly. When obligations arrive — a deletion request, an audit, a regulator's inquiry — the question is not whether you take privacy seriously. Everyone says they do. The question is whether you can prove it.
Sincerity is not a defense. Evidence is.
This is the gap Pacific Data Integrators built Kestryl to close. Not another scanner that produces a list. A system whose entire design goal is to make the answer to “show me” immediate, complete, and reproducible.
02 The principle
Any pattern-matcher can flag something that looks like a national ID. The difference between a tool and a defense is everything that happens around the match: whether a number that merely looks valid is verified against its real check digit; whether the same search, run again next quarter, produces the identical result; whether every action leaves a record that cannot be quietly edited after the fact.
Kestryl treats a finding as evidence from the moment it is made. Three things travel with every one:
Each candidate is checked against the published validation for its type — the published mathematical validation for a payment card, the checksum validation key for an IBAN. A number that cannot mathematically exist is never reported as if it does.
The exact set of definitions in force is reduced to a short, deterministic signature. Same rules, same signature, on any machine, forever. It is how you answer “what were you searching for on the 14th” with certainty rather than recollection.
Every masking action is recorded in a chained log where altering one line invalidates the next. The audit trail is not a report you generate afterward. It accrues as the work happens.
None of this is visible in a list of hits. All of it is what a regulator's technical team actually examines. The design choice PDI made is to optimize for the second audience from the first line of code.
03 How it works
Kestryl reads the places personal data hides and routes all of it through the PIIScan detection core, including OCR for scanned documents and a locally deployed NER model for contextual entity detection. Structured records from the data warehouse. Free text in support cases and notes. Native and scanned PDFs. Images, down to the coordinates embedded in a photograph. Whatever the source, the text it yields is judged by the same rules and the same validators, so a finding means the same thing everywhere.
When a value is confirmed, one of two things happens — and which one is never left to chance. By default the system records and changes nothing: findings accrue, source data is untouched. In structured records, masking is possible — the confirmed value is replaced in place with *** — but it demands two independent keys turned together: a setting in the configuration and a deliberate instruction at run time. It is the difference between a smoke detector and a sprinkler, and no single hand can trip it by accident. In PDFs, scanned documents, and images, Kestryl identifies and locates PII for review; source documents are never altered.
04 Measured, not promised
Sampling is where privacy programs go to fail — the record that surfaces in litigation is invariably the one that was not in the sample. Kestryl is built to scan the whole population. The figures below are measured on a single, deliberately modest processor core; production hardware widens every one of them.
Where we are precise on purpose
Structured and native-text scanning sustain the rates above comfortably. Optical recognition of scanned pages is bound by page count, not row count — roughly a fifth of a second per page, per core — so throughput there scales with the compute you assign to it, and we size that openly per engagement rather than quoting a single headline number. We would rather tell you exactly where the wall is than have your technical team find it after signing.
Every scan closes the same way: a plain summary any executive can read, a line-by-line extract for the analysts, and the rules fingerprint stamped across all of it. The original values never appear in a report. They exist in one controlled place, under separate lock.
05 What you actually receive
This is not a mock-up. It is the output of a scan against 25 million customer records, reproduced as delivered. Two things are worth your attention before the numbers: what the engine refused to report, and the line it drew through what it found.
Reproduced from run 19f9a4f4053. Counts are exact; no values are shown.
A quarter of a million strings in that data looked exactly like payment cards. Right length, right shape, right place. Every one of them failed its check digit, so the engine discarded them silently and they appear nowhere in your findings. A tool that reported them would have handed your team 125,000 false alarms to work through — and handed a regulator 125,000 reasons to doubt the rest.
The 75,000 passport-shaped matches below the floor are the more interesting half. They were found, they were recorded, and they were deliberately left alone, because nothing nearby corroborated them and the engine's confidence never cleared the threshold you set. They stay visible for a human to review and remain permanently outside the reach of automated masking.
The discipline is not in what it finds. It is in what it declines to act on.
06 Operable by design
Sophistication in the engine does not mean complexity in the hands of the team running it. What Kestryl looks for, how certain it must be before it acts, and whether it may act at all are set in a single readable file — in language a careful non-specialist can operate. Adding a company-specific identifier is a few lines. Turning on document scanning is one word.
The safeguards are built into the grammar. A change the system does not understand does not run — it stops and names the line, because a tool that can mask data should never guess what you meant. And every edit changes the fingerprint, so a rule set can never be quietly confused with a different one.
07 Why Pacific Data Integrators
Kestryl did not arrive from a whiteboard. It comes from a firm that has spent more than fifteen years and a hundred-plus implementations inside the enterprise data stack — Informatica, Salesforce, Snowflake, Databricks — for banks, insurers, healthcare, government, and retail. PDI knows where personal data collects in a real CRM, because PDI has spent years cleaning those systems for a living.
That lineage is the point. A privacy defense is only as good as its fit to the systems it protects. Kestryl joins a portfolio — alongside PDI's data-quality work on Salesforce — built on the same conviction: that trustworthy data is not a report you produce for an audit, but a property you can prove at any moment.
The goal was never to find more. It was to be believed.
The brands that will lead the next decade are the ones that can look a customer, a board, and a regulator in the eye and prove how personal data is handled — not assert it, prove it. Pacific Data Integrators can show you what that looks like against your own data, under your own constraints.
RULESET SIGNATURE · 09a08673aa6e9ccb · deterministic across environments