BigID vs Securiti: how they compare in 2026

Machine learning is the engine of the core capability and the platform around it would still function without it. BigID's discovery and classification page contrasts its own approach against legacy tools in exactly those terms: basic classification relies on static regex, keywords and brittle rules, while BigID uses machine learning, natural language processing, pattern recognition, metadata, context, custom rules and classifier tuning; the pricing page describes machine-learning-augmented metadata collection, search and labelling at petabyte scale. Classification is the foundation the rest sits on, since privacy operations, posture management, retention and deletion all act on what the classifier found. But the product a buyer licenses is a platform of bundled applications, and a data discovery product built on pattern matching alone is a coherent product that competitors ship. Generative capability is explicitly optional: the subprocessor list records Amazon Bedrock and Azure OpenAI as providing large language model inference for optional features described in the documentation. Discovery and classification page, AI security and governance page, pricing page and subprocessor list read 7 September 2026.

AI is present in three distinct ways here and none of them makes the models the product a legal buyer is paying for. First, as subject matter: AI Governance, EU AI Act and NIST AI RMF pages sell the ability to govern a customer's AI, which is the product managing someone else's models. Second, as infrastructure for the customer: Gencore AI vectorises and sanitises data for training, runs prompt, retrieval and response firewalls, and builds copilots, which is AI plumbing rather than AI doing the buyer's work. Third, and closest to this axis, as technique inside classification and the DataAI Command Graph. Strip the models out and what remains is fully saleable and is most of the platform: data discovery and scanning across a stated thousand-plus integrations, a catalogue, lineage, a data map producing records of processing activity, DSR workflow, consent capture, assessment templates and breach notification. Consistent with the comparable platform in this lane, which took the same grade for the same structural reason.

Accuracy is asserted throughout and measured nowhere. The classification pages promise to improve accuracy, reduce false positives, improve precision and tune classifiers, and the comparison against legacy tools rests on being more accurate than pattern matching; no accuracy rate, precision or recall figure, test set or evaluation appears on any surface read. The vendor's own agreement points the other way: clause 9.6 of the licence disclaims any warranty of the accuracy or completeness of data or informational content. Most limbs of this band do not bite for a product that emits classification labels and risk findings rather than legal assertions, and that is named rather than penalised: there is no citation to ground, no authority to open and no reader-verifiable source. What is graded is the limb that does bite, which is that a claim to classify sensitive data more accurately than the alternative is the product's central promise and nothing published lets a buyer test it. Discovery and classification page, licence agreement and pricing page read 7 September 2026.

Accuracy is asserted repeatedly in the marketing and measured nowhere. The claim appears in the product copy as accurately classifying data, discovering shadow and cloud-native assets, and delivering unified intelligence, and classification precision is the decisive quality metric for a discovery and posture-management product: a missed store of personal data is the failure mode that matters, and an over-broad match creates work that erodes trust in the tool. No precision or recall figure, benchmark, test set or false-positive rate was located on any surface read on 1 September 2026. Two limbs of this axis do not bite, since the platform does not retrieve legal authority and produces no citations a reader would open. The agreement is more candid than the marketing on this point and is graded on the liability row: Securiti warrants substantial conformity with the Documentation rather than accuracy of any classification result.

Autonomy is claimed over consequential actions and oversight is asserted without a described control structure. The platform is sold on turning findings into action rather than reports: labelling, minimisation, deletion, redaction, quarantine, policy enforcement and remediation workflows, with policies enforced across access, sensitive prompts, data usage and AI responses. Those are irreversible operations on a customer's production data. What exists on the oversight side is real but partial: the classification FAQ describes validation workflows and classifier tuning, which is a mechanism for checking the model's output before it is trusted, and remediation is described as running through workflows rather than silently. What is not published anywhere read is the threshold at which the platform acts without a person, what approval a deletion or quarantine requires, or what happens when a classification is wrong and data is removed on the strength of it. Discovery and classification page, AI security and governance page read 7 September 2026.

Oversight is sold as a product and not described as a control over the vendor's own output. Securiti ships genuine runtime controls, with context-aware prompt, retrieval and response firewalls for large language models and Agent Commander for detecting and undoing AI agent mistakes, but every one of those governs the customer's AI systems rather than Securiti's classification and assessment engine. On its own side, nothing located states what runs unattended, what confidence threshold causes the system to defer, where a reviewer sits relative to a classification decision, or what happens after a classification is wrong. Assessment Automation implies human authorship of assessments without describing a checkpoint over machine output. The agreement is the only place a supervision expectation is stated and it points at the customer: the disclaimer records that the product augments rather than replaces professional advisors, and that the customer must confer with legal counsel as needed. That places responsibility rather than describing a mechanism.

Analyst recognition and an unattributed scale claim stand in for deployment evidence on the surfaces read. The homepage states that BigID is trusted by Fortune 500 enterprises without naming one; the certifications and product pages carry association and analyst marks including the Cloud Security Alliance, the EDM Council, the World Economic Forum and a CDMC certified-solution logo; the classification page links a Forrester Wave naming BigID a Leader in sensitive data discovery and classification for Q2 2026, and a blog post quotes an IDC MarketScape assessment. Analyst placement is a third-party judgement about the market rather than a record of what a customer achieved. No named customer, no dated deployment and no figure for what changed was located on any page read. The customer stories page at the why-BigID surface was not read and is the route to a higher grade; this grade records what is establishable today rather than a finding that no such evidence exists. Homepage, certifications page and classification page read 7 September 2026.

Named organisations, named individuals with titles and dates, and no figures for what changed. The Spotlight Talks series carries on-the-record interviews with a director of global analytics at Dye and Durham, an SVP of product at Walker and Dunlop discussing a 135 billion dollar portfolio, and named executives at Sanofi, Volkswagen and International Flavors and Fragrances, each dated between April and June 2025. That is materially better attribution than most of this corpus, and it is interview material rather than outcome measurement: no before-and-after metric, deployment scale or time saving is attached to any of them. Analyst recognition is extensive but is not deployment evidence, spanning GigaOm, Frost and Sullivan, IDC MarketScape, Forrester Wave, Gartner Cool Vendor and an RSA Conference Innovation Sandbox win. **One piece of context belongs on this row**: section 9.2 of the customer agreement obliges customers to join Securiti's reference programme and to develop a profile including an executive quote and logo, so the supply of testimonials is a contractual term rather than purely voluntary.

Substantive published commitments on confidentiality and access, short of segregation and of what the model providers may retain. Customer Data is the customer's Confidential Information under licence clause 6.1 and the customer owns it under 8.2; the receiving party may use it only to perform the agreement and may disclose only to representatives who need to know under equivalent obligations. The Data Processing Addendum adds that BigID processes personal data only on documented instructions, that personnel authorised to process it are under a duty of confidentiality surviving their employment, that access is limited to those providing the software, and that all personal data is deleted within thirty days of termination. Schedule 3 backs that with need-to-know access control, a privileged access management broker for production and multi-factor authentication. Two limbs are missing. Nothing published addresses segregation between customers or between matters inside a tenant beyond the general security programme. And nothing states what Amazon Bedrock or Azure OpenAI retain when the optional generative features are used, which is the limb this band names most often. The training position is graded on its own signal and is not repeated here. Licence agreement, DPA and Schedule 3 read in full 7 September 2026.

The architecture is documented with unusual specificity and the question is answered in the vendor's favour rather than the customer's. On the strong side, and all of it published in the agreement or its security exhibit: per-customer virtual database instances logically separating one customer's data from another's and destroyed when the customer stops using the service; personal data identified by the platform subjected to a one-way irreversible hash, with a commitment that personal data is at no point captured in clear text in logs or databases; mutual contractual confidentiality with a notice-and-opportunity-to-contest provision for legally compelled disclosure; customer ownership of Customer Data; and deletion of all Customer Data from online systems within one business week of a confirmed request. Against that sits the term that decides this axis. **Section 2.1 grants Securiti a royalty-free, worldwide licence to use Customer Data both to provide the service and for the purpose of enhancing product or services**, with no carve-out for model training and no definition of what enhancement covers. Privilege and work product are not addressed, and no position on third-party model providers exists.

A boilerplate disclaimer sits in the terms while the marketing describes compliance outcomes, and nothing addresses where the product's output stops and a legal judgement begins. The platform is sold on proving compliance, generating audit-ready evidence, tracking regulatory and control risk, and supporting regulatory reporting across privacy and AI regimes, which is language about legal status. The only counterweight located is licence clause 9.6, disclaiming any warranty of the accuracy or completeness of data or informational content, which is a warranty disclaimer rather than a statement about advice. Nothing published says that a RoPA, a privacy impact assessment or an AI risk score produced by the platform is not a legal conclusion, that a privacy counsel remains responsible for the determination, or which jurisdictions the regulatory content covers. The audience is unambiguous and professional, which is recorded rather than credited. This is the same grade the index has given OneTrust, Transcend and DataGrail on the same axis and the same product class. Site pages and licence agreement read 7 September 2026.

A real position on advice versus tooling is published in the agreement itself, which is more than most of this lane manages. The disclaimer at section 5.4 states in terms that the customer acknowledges the product is intended only to augment the customer's privacy practices but not replace legal and other professional advisors, and that the customer is a data controller responsible for what data it collects and for its own privacy policies. Section 2.5 reinforces it operationally: the customer assumes full responsibility as controller, warrants that it has complied with transparency obligations and obtained the necessary consents and legal bases, and, in an unusually direct sentence, records that it is the customer's responsibility to confer as needed with legal counsel to confirm and maintain compliance with applicable laws. That is a published allocation of the professional judgement, addressed to the person who will rely on the output. What is missing is the rest of the treatment: no jurisdiction limit is named for the tool's own coverage, nothing addresses the supervision or competence duties of the practitioner using it, and no professional guidance is referenced anywhere.

Responsible AI principles are published without a mechanism a buyer could audit, which is a notable position for a vendor that sells AI governance. The certifications and assessments page carries a Responsible AI section stating that BigID applies governance, testing, transparent data practices and privacy-by-design principles to support fairness, accountability and trust in its AI-enabled capabilities. Nothing published stands behind it: no governance framework or policy document, nobody named as accountable for the behaviour of BigID's own models, no description of what is tested before a classifier ships, no result from any such testing, and no disclosure about uneven classification output across data types, languages or populations. The eight certifications listed on that page are security and cloud assurance standards, and ISO 42001, the management standard for artificial intelligence that this index has treated as sufficient for the band above, is not among them. The asymmetry is worth stating plainly, because the platform inventories other organisations' models, scores their risk and produces evidence of their governance while its own classifiers, whose output determines what is labelled sensitive and what is deleted, carry none of that disclosure. Certifications page and AI governance page read 7 September 2026.

Nothing published addresses governance of Securiti's own models, and the contrast with what the company sells is the point. Securiti publishes extensive material on AI governance frameworks as product capability, with dedicated pages for the EU AI Act, the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications and CDMC, and an AI Governance module sold to establish controls for the safe adoption of AI. None of that is Securiti's own governance. No responsible-AI page, AI policy, ethics statement, AI governance committee, named accountable owner, pre-release testing regime or bias evaluation was located. The site navigation was read in full on 1 September 2026 across products, solutions, resources and company sections and contains no such surface; the Company menu offers About Us, Partner Program, Contact, News Coverage, Press Releases and Careers, and the footer offers terms, security, cookie preferences and privacy request routes. The security exhibit designates a security official and a cross-functional Security Council, which is information security governance rather than AI governance. **A vendor selling AI governance publishes none of its own.**

Retention, deletion, access control, subprocessors and incident practice are all published, current and specific enough to hold the vendor to, in a security schedule that is contractually binding rather than a marketing page. Schedule 3 of the Data Processing Addendum commits BigID to a documented cryptography policy with encryption of all personal data in transit and at rest, single sign-on multi-factor authentication with every production connection brokered through a privileged access management solution that logs the connecting user, need-to-know access with timely removal on role change, mandatory security training and background checks, anti-malware, OWASP-based secure coding with security testing of all code, change and patch management, disaster recovery with restoration to a region separate from the primary, event logs retained at least one year, annual third-party penetration testing and periodic vulnerability scanning, and remediation windows tied to CVSS severity: forty-eight hours for a zero-day, seven days for critical, thirty for high and sixty for medium. Incident practice is defined: a Security Incident is defined in the DPA with unsuccessful attempts expressly excluded, notice is due within seventy-two hours of BigID becoming aware, and BigID must investigate, mitigate, identify the circumstances and cooperate on request. Deletion is thirty days from termination with data made irretrievable, and the customer may export at any time. Subprocessors are published individually with purpose and location and carry a thirty-day objection right with a termination remedy. DPA and Schedule 3 read in full 7 September 2026.

Substantive, specific and published across most of the ground, short of a named subprocessor list. The security exhibit to the customer agreement is unusually concrete. Deletion carries a stated window: on a customer request filed by ticket or email, Securiti deletes all Customer Data from online systems within one business week of confirmation, with retention only where applicable law requires. Incident practice carries a stated deadline and method: notification of a security breach as soon as practicable and no later than seventy-two hours after Securiti becomes aware, by email with a read receipt to a designated address, with Securiti barred from informing third parties without approval and the customer holding sole right to decide whether affected consumers are notified. Access control is role-based, reviewed regularly and monitored, with a stated subset of personnel able to reach customer data. Testing is described with dates attached to cadence: annual third-party penetration tests and audits, weekly internal scans, disaster recovery tested twice a year with an executive summary available to customers on request. Devices carry a minimum of AES-128 full disk encryption. What is absent is the subprocessor limb: third parties appear only as categories such as IT service providers and cloud providers, with none named, and the CCPA addendum has the customer pre-approve transfers to Securiti's affiliates, service providers, third parties and vendors without identifying them.

What the vendor stands behind is published and specific, and one term goes beyond what any other record in this lane offers. Licence clause 10.1 gives an indemnity and defence against third-party claims that the software infringes intellectual property rights, with five named exclusions and the procure, modify-or-replace, or terminate-with-pro-rata-refund ladder. Clause 11.2 caps each party at the annualised fees paid during the current subscription term, and 11.3 lifts both that cap and the exclusion of indirect damages for breach of confidentiality, for the indemnities, for gross negligence or wilful misconduct, and for infringement of the other party's intellectual property. Then it does something unusual: it sets a dedicated ceiling for BigID's liability for breach of its security, data privacy or data protection obligations, including under the data protection agreement, at the greater of four hundred thousand dollars or twice the annualised fees. For a customer whose entire sensitive data estate is being scanned, that is the exposure that matters and the agreement prices it explicitly. Clause 9.3 warrants that the software will substantially conform to the documentation, with a thirty-day claim window and correction or pro-rata refund as the exclusive remedy, and 9.6 disclaims accuracy and completeness of informational content. No insurance is stated. Licence agreement read in full 7 September 2026.

Every limb this band names is published and specific, and one of them appears here for the first time in the corpus. The indemnity runs two ways rather than one and covers more than intellectual property: Securiti defends the customer against third-party claims that use of the product infringes a US patent, copyright, trade secret or trademark, **and separately against claims arising out of any use or disclosure of Customer Data by Securiti in breach of the agreement**, which is a indemnity rather than the IP-only indemnity that is standard in this corpus. The cap is stated with a hard ceiling: direct damages limited to the lesser of amounts paid under the applicable order form in the preceding twelve months **or one million dollars**, with the usual consequential-damages exclusion running mutually and the customer's payment obligations carved out. A warranty a buyer can invoke commits the product to substantially meet the order form requirements, substantially conform to the documentation and be free of malicious code, with re-performance, termination and a pro-rata refund as the exclusive remedy. **An insurance position is published, which no other record in this pull carries**: errors and omissions, professional liability and cyber cover of not less than three million dollars per claim and in the annual aggregate, maintained through the term and for two years after, with thirty days' notice of cancellation. A service level agreement adds 99.5 per cent availability, tiered credits and a termination right below 92 per cent for three consecutive months. Nothing is specific to an AI output being wrong.

Breadth of connection is documented in the vendor's own material, short of depth an implementer could work from. The platform's premise is reaching data wherever it sits, and the classification page enumerates the classes it covers: structured, unstructured and semi-structured data, cloud, SaaS, on-premise and hybrid environments, messaging, data lakes, development tools and AI-connected sources including models, agents, copilots, prompts, vector stores and pipelines. A data coverage catalogue is published with filters by integration type, and the licence agreement prices the subscription partly on the number of data sources and connectors, which confirms connectors are a licensed unit rather than a claim. What is not established from the pages read is depth: no description of what a given connector reads, in which direction, at what frequency, or what a customer must configure. The coverage catalogue itself was not read and is not credited by its title. The systems named are enterprise data platforms rather than practice systems, which for this product class is the honest description rather than a deduction. Discovery and classification page, licence agreement and site navigation read 7 September 2026.

Real integrations exist, are named, and stop short of documented depth. Securiti states more than a thousand integrations across data systems and names the principal ones on its own navigation: AWS, Google Cloud, Azure, Snowflake and Databricks each carry a dedicated page, with a connectors index behind them. What travels is describable at a high level from the product set, since discovery, classification, access intelligence and lineage all operate by reaching into those systems and reading their contents, and downloadable components are deployed inside the customer's own environment for parts of the platform. What is missing is the implementer's view: no API reference or connector specification was located on the pages read, and nothing describes the direction or granularity of what moves for any individual system. A documentation site exists at docs.securiti.ai, listed among the company's own internet-facing assets in the published system description, and **was not opened on 1 September 2026**, so depth was neither confirmed nor excluded.

Deployment options, what changes between them, and processing as distinct from storage are all published, and the first of those is unusually concrete. The licence agreement defines two deployment types that an order must specify: on-premise self-managed software installed on the customer's own systems, and hosted cloud software. Schedule 3 of the DPA then states which security measures apply to which, recording that for an on-premise deployment only the certifications and audits, personnel training and confidentiality, and secure coding sections apply, because the rest govern infrastructure BigID does not operate. That is a published account of what a buyer gains and gives up by choosing a tier, which most records on this axis do not offer. On residency, the subprocessor list gives AWS as the cloud infrastructure with an entity location of US and EU, and every other subprocessor is listed with its location; the certifications page adds TX-RAMP Level 2 for Texas public sector workloads and the subprocessor list names a separate infrastructure partner used only for FedRAMP deployments. Processing is addressed separately from storage: DPA 4.1 discloses that BigID may transfer personal data internationally to its personnel for support and maintenance and to subprocessors, under Standard Contractual Clauses, the UK Addendum and EU-US Data Privacy Framework membership, and Schedule 3 records that BigID is remote-first and uses subprocessors to process and store customer data. Region granularity is coarse, given as US and EU rather than named regions. Licence agreement, DPA, Schedule 3, subprocessor list and certifications page read 7 September 2026.

The deployment model is stated plainly with partial residency detail. The published system description sets out a multi-tenant cloud service hosted on AWS and GCP, with per-customer virtual database instances providing logical separation, and adds a genuine hybrid element in downloadable components that must be deployed inside the customer's own environment. Residency is real rather than gestural: platform instances sit in multiple geographically distributed data centres, and the company states that **each instance serves customers from a specific geography as a standalone offering with no data exchange between instances**, which answers the processing question more directly than most vendors manage. Two clouds are identified concretely by their own endpoints, a Global Production Cloud and an **EU Production Cloud** at app.eu.securiti.ai with its own status page. Resilience detail is published, with daily backups copied to a different data centre in a different region, a pilot-light disaster recovery strategy, multi-availability-zone failover and a stated 24-hour RTO and RPO. What keeps this below the top band is that the full list of available regions is never enumerated beyond the EU and Global clouds, and nothing describes what changes between deployment tiers.

Certification is real, named and contractually committed, short of reachable evidence and dates. The certifications and assessments page lists ISO 27001, SOC 2, a SOC 3 general-use report, CSA STAR with a completed CAIQ self-assessment published in the STAR Registry, CDMC, PCI DSS and TX-RAMP Level 2, alongside a Wiz recognition. Schedule 3 of the DPA turns two of those into obligations: BigID will maintain a certificate from a reputable third-party certification authority evidencing compliance with ISO/IEC 27001, and will obtain and maintain an SSAE18 SOC 2 Type II report covering any system or process used in processing personal data, which is a scope statement rather than a badge. Reports are available on written request no more than once a year, and the DPA separately allows a third-party risk assessment satisfied by a questionnaire such as a SIG Lite. What is missing is the accessible half: no auditor, no audit period, no certificate number and no report date appear anywhere read, and the trust centre was not opened. One wording gap is worth a reader's notice and runs opposite to the usual direction: the public page says BigID is aligned with ISO 27001 while the binding schedule commits it to hold a certificate. Certifications page and DPA read 7 September 2026.

The certifications are real and named, and none of the evidence is reachable without asking. Securiti states SOC 2 Type II certification with a copy of the report available on request to prospective and current customers, and holds **ISO 27001:2022 and ISO 27701:2019**, the latter being the privacy information management standard and a sensible one for this product. The customer agreement backs the SOC 2 position contractually, committing Securiti to provide its most recently completed SOC 2 report or an industry-standard successor on request. Supporting detail is unusually good for a vendor with no trust portal: the published system description names AWS and GCP as the underlying providers and describes the shared responsibility split, annual third-party penetration tests and audits, weekly internal scans, and a disaster recovery test executive summary available on request. What holds it below the top band is access and specificity. There is no trust centre and nothing is downloadable; no auditor or certification body is named for any of the three; no certificate date, examination period or scope statement appears; and every route to the evidence runs through a request. Under the gated-is-not-absent tiers this is the self-serve request tier, materially better than absent and short of open publication.

The providers are named on a published list with their role and location, and the models are not. The subprocessor page, last modified 7 July 2026, records two entries for large language model inference, Amazon Web Services through Bedrock and Microsoft through the Azure OpenAI Service, each described as supporting optional features as described in the documentation and each located in the US, alongside the wider list of infrastructure, storage, search, authentication, monitoring and analytics providers with their purposes and locations. That tells a buyer whose models process its data when the generative features are switched on, and that they are optional, which is more than most records disclose. Three things are absent. No model or version is named, and provider naming is not model naming. No commitment is given about where inference runs beyond the US location on the list. And change notification is soft on the page itself, which says BigID will endeavour to give notice of new subprocessors to the extent required under the agreement, although the DPA supplies the harder mechanism of a maintained list, notification and a thirty-day objection right with a termination remedy. Subprocessor page and DPA read 7 September 2026.

The platform is built around models and identifies none of them. Securiti describes a knowledge graph at the core, classification across structured and unstructured data, vectorisation and ingestion into vector databases, curation and sanitisation of data for model training and tuning, and prompt, retrieval and response firewalls for large language models. Every one of those implies models, and no model, model family, provider or architecture is named anywhere on the surfaces read on 1 September 2026. Nothing states whether a third-party foundation model is called at any point in classification or in the copilot products, and nothing excludes one. AWS and GCP are named as infrastructure providers, which identifies where workloads run rather than whose models they are, and does not answer this axis. No commitment to notify customers when the model set changes was located. This sits above the bottom band because the architecture is described in real terms rather than gestured at, and below the band above because nothing underneath it is identified.

The shape is published in detail and the number is not published at all. The pricing page states the model plainly: pricing depends on the number of data sources, applications and connectors, the deployment type, and the level of services and support, and a quote requires contact. The feature split is published rather than hidden, with the Discovery-in-Depth foundation described and eight named bundles listed with their component applications, five for security and three for privacy, so a buyer can see what is grouped with what before speaking to anyone. A free trial is offered through the same form. The licence agreement adds the mechanics: fees are set in an order, payable in US dollars within thirty days, one per cent monthly interest on late amounts, and a licence true-up under which the customer monitors its own usage against the licensed data source and volume metrics, must notify BigID if it exceeds them, must certify compliance on request up to twice a year, and pays excess fees for overage. That last term is a real cost exposure a buyer should read before signing. No figure, band or rate appears anywhere. No VendorPricing row is written, since a row belongs to vendors graded A or B on this axis. Pricing page and licence agreement read 7 September 2026.

No figure and no tier are published anywhere, and the charging unit is nonetheless readable, which is an unusual combination worth recording precisely. The site navigation was read in full on 1 September 2026 and contains no pricing page; every commercial route on every page is a demo request or a contact form. What is published sits in the customer agreement rather than in marketing: the number of Authorized Users accessing the product is capped by the figure specified in the order form, which identifies the unit of charge as named users; fees are quoted and payable in United States dollars; payment obligations are non-cancellable, non-pro-ratable for partial months and non-refundable; late payment carries interest at one and a half per cent per month; and subscriptions renew automatically for successive terms equal to the initial term unless either party gives thirty days' written notice. The service level agreement adds a published credit schedule of four, six and ten per cent against availability bands. So a buyer can read the shape of the commercial relationship in advance while learning nothing about what it costs, with no rate, band, package or tier name published at any point.

Who the product is for is described with substance across several dimensions, and the boundaries are left open. Buyer functions are addressed by name through the solution structure: security teams through posture management, cloud data loss prevention, access governance and insider risk; privacy teams through data subject requests, consent, records of processing activity and impact assessments; and AI governance teams, whom one section addresses directly with the questions they need answered. Environment coverage is stated across cloud, SaaS, on-premise, hybrid and AI systems, and regulatory coverage has its own published surface. Deployment reach into regulated sectors is evidenced rather than claimed, through TX-RAMP Level 2 for Texas state systems, a FedRAMP deployment path and PCI DSS assessment. What is not stated is any limit: no jurisdiction, regulation, data type or organisation size is named as out of scope, the Fortune 500 claim carries no basis, and there is no statement of what the platform does not cover. For an index of legal buyers the relevant boundary is also unstated, since nothing describes what a law firm rather than an in-house function would do with the platform. Site navigation, AI governance page, classification page and certifications page read 7 September 2026.

Coverage is documented across three axes with real substance behind each, and the boundary is left open. Six industries carry dedicated pages: financial services, healthcare, telecom, retail, travel and hospitality, and manufacturing. Regulatory coverage is named rather than gestured at, with individual pages for GDPR, California's CPRA, Brazil's LGPD, Canada's PIPEDA, China's PIPL, the EU AI Act, the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications and CDMC, behind a wider index. Technology coverage is quantified at more than a thousand integrations with the major cloud and data platforms named. What is not stated is where the product stops, with no statement of organisation size, data volume, or the environments and obligations it does not reach. The buyer picture carries the same gap seen across this lane: the Roles navigation offers Data+AI Builders, Data Security, Data Privacy, Data Governance and Marketing, and **no page for legal or counsel**, even though the privacy pillar is the work a data protection officer or privacy counsel owns and the agreement itself tells the customer to confer with legal counsel.