Skip to main content
Ollandi
Contact sales

Sensitive data protection · Domain Intelligence Pack

Data DIP

When a stolen account starts copying customer records, the leak stops early, with evidence ready for your regulator.

Contact sales

Overview

Stop the copy before it becomes a breach

Data leaks start quietly. A valid account reads more than it should. An export lands in a personal inbox. A folder gets shared with anyone who has the link. By the time a customer list appears for sale, the trail is months old and your privacy team has little time to notify. Ollandi stops that kind of copying while it is still small, and keeps the record your privacy team will need.

  • Ollandi finds which systems hold personal, payment, and health data, which country each copy sits in, and who normally reads it.

    • Databases, data warehouses, and data lakes
    • File shares, cloud storage, and shared links
    • Backups, replicas, and test copies of production data
    • Where personal and payment data lives, and which country holds each copy

  • An unusual copy raises a case in its first minutes. The forgotten public link and the unencrypted backup are found before an outsider finds them.

    • Bulk reads far beyond an account’s normal pattern
    • Exports to personal email, new cloud storage, or unknown hosts
    • Production data copied into test or analytics environments
    • Folders shared with anyone who has the link
    • Backups that stopped running, or stopped being encrypted

  • Cases list the exact records and the people they describe, so your privacy team can judge its notification duties from facts.

    • Which records are involved, and whose they are
    • Who or what accessed them, and through which application
    • Whether a job, migration, or approved request explains it
    • What your privacy team will need for a breach notice

  • A suspended session or a closed link can be restored at once. Deleting data and notifying anyone remain decisions for your privacy team.

    • Suspend the session or credential doing the copying
    • Close a public link or block one export path
    • Preserve the access trail under a cryptographic chain of custody
    • Pass account and notification decisions to your privacy team
    How you set the limits

In an incident

A reporting account pulls the full customer table on a Sunday

An illustrative case, step by step, from the first signal to a confirmed result.

  1. Notice

    On a Sunday afternoon, a reporting account that reads a few thousand rows a day starts pulling the full customer table.

  2. Judge

    No report is scheduled and no migration is planned. The data is heading to a storage account outside the country. Ollandi treats the credential as stolen.

  3. Stop

    After checking the reports that rely on the account, Ollandi suspends the session and blocks the export path. Either step reverses cleanly.

  4. Prove

    Your privacy team gets the record count, the people affected, the timeline, and every decision, ready for the regulator.

Connections

What it connects to

Ollandi reads audit trails from PostgreSQL, Microsoft SQL Server, Oracle Database, and MongoDB, plus cloud storage and sharing in Google Workspace and Kimpa Workspace. It works from metadata and access records, so sensitive data does not have to be copied to be protected.

  • Database and warehouse audit logs
  • Cloud storage and file-share access
  • Data classification and residency maps
  • Identity and session records
  • Backup and retention status
  • Workspace sharing and email activity
Review the architecture

Domain Intelligence Packs

Add depth in other domains

Packs check one another’s work. A strange sign-in found in one domain can confirm, or rule out, what another domain found.

See all packs

  • Cloud DIP

    Close the cloud gaps attackers look for first: public storage, open ports, and roles with more access than they use.

  • Identity DIP

    Stolen credentials stop working at the first sign of misuse, whether they came from phishing, a SIM swap, or a leaked key.

  • Runtime DIP

    Ship on a Friday with confidence. A bad release or a vulnerable image is caught in production and rolled back within your rules.

  • Network DIP

    An intruder moving between servers is stopped at the next hop, and a failing link is flagged before transactions fail.

  • Endpoint DIP

    Ransomware contained on the first device it lands on, long before it can reach a file server or a backup.

  • On-premises DIP

    The legacy systems the business still depends on stay up and defended, including the ones nobody on the team owns anymore.

  • Applications and code DIP

    Reachable flaws in your code and dependencies come with a fix ready to merge, and bots and account takeovers stop at sign-in.

  • Operational technology DIP

    Plants keep producing while attacks on controllers and remote access are stopped, and the control room keeps the final say.

  • ATM DIP

    Engineers go out only when a visit will fix the fault, and jackpotting is cut off before the cassettes empty.

FAQ

Frequently asked questions

  1. No. Ollandi works from access records, metadata, and classifications. Retention is agreed with you, and an on-premises license keeps everything inside your own environment.

  2. Not when the job is known. Scheduled jobs, migrations, approved requests, and the account’s history are weighed before anything is restricted. Volume alone is never the reason.

  3. Each case records which records were touched, whose they were, when, and by whom, under a cryptographic chain of custody. Your privacy team prepares notices under the NDPA, GDPR, or HIPAA from facts. Ollandi supports the evidence, and the decision to notify stays with you.

Get started

Put the Data pack to work

Bring a data incident you had to report, or nearly did. We will show who touched what, through which service, and where Ollandi would have stopped it.

Contact sales