pii-eu finds national ID numbers, IBANs, cards, contact and health data in your code, test files, logs and exports, proves each match with the identifier's own rules, and drafts your GDPR record of processing from the software itself.
Supporting evidence for your record of processing, not legal advice. Found values are masked in every report.
The record of processing is a spreadsheet filled in from interviews, while the software keeps changing underneath it.
The data protection officer asks each team what they store. The answers are out of date the week after, and nobody can show where a line came from.
A real customer's ID copied into a test file, an email address written to a log, an export left in a shared folder. Nobody meant it, nobody noticed.
US-built tools miss most EU national IDs. Pattern searches flag every 13-digit order number, and after a few hundred false alarms nobody reads the report.
pii-eu runs where your files already are, on a laptop or in CI, and nothing it reads leaves the machine.
Code, test files, logs, CSV and JSON exports, archives and saved container images, read in one pass. Each value is masked the moment it is found.
Most identifiers carry their own proof: a check digit, a date of birth, a region code. pii-eu redoes that arithmetic, so an order number with the same shape is left alone.
Schemas, models and Terraform become an inventory: which store holds which personal data, who receives it, and whether it can be erased.
On every change, the map is compared with the last release. A new kind of personal data, or a new outside company receiving it, is held until someone approves it.
order_id 5034172093861 has the same shape, but month 41 doesn't exist| Store | Personal data | Source |
|---|---|---|
| users PostgreSQL | National ID, email, phone | db/schema.sql:14 |
| patients PostgreSQL | Health data Art. 9 | migrations/0007.sql:4 |
| app logs CloudWatch | Email, via log.info | checkout/notify.py:13 |
| exports S3 · eu-central-1 | Customer CSV, encrypted | infra/s3.tf:3 |
| Stripe outside company | Name, card | billing/charge.py:21 |
patients.diagnosis holds health data (GDPR Art. 9). The record of processing needs a purpose and a legal basis before this ships.pii-eu map --diff · supporting evidence, not legal adviceEngineers set it up once. Privacy, security and audit read what it finds, each in their own terms.
Instead of interviews: every field that holds personal data, where it is stored and who receives it.
The leaks that turn into incidents: logs, dumps, buckets and images.
Quiet by design: few warnings, and the ones you get are real.
One self-contained report per system, run on the client's own machines.
Inside Clause Eight. pii-eu runs as one of Clause Eight's scanners, and its findings become evidence for the GDPR and, for card data, PCI DSS, next to everything else Clause Eight collects.
Measured on 30,000 generated lines, one in three holding a valid identifier, the rest the noise real repositories are full of.
It keeps a scanner's speed and gives the privacy team the record they actually need.
| What you need | Generic PII scanners | A hand-kept record | pii-eu |
|---|---|---|---|
| Finds EU national ID numbers | Mostly US identifiers | Only what people remember | 32 countries, each by its own rules |
| Tells real data from lookalikes | Pattern matches, many false alarms | Not applicable | Check digits, dates and region codes |
| Drafts the Art. 30 record | No | Yes, by interviews | From schemas, models and Terraform, with file and line |
| Finds personal data in logs and analytics | Rarely | No | Log, error-tracker and analytics calls |
| Stays current | Per scan | Once a year | Compared on every change |
| Keeps your data in house | Cloud tools copy it out | Yes | One program, no network calls |
Typical capabilities by category; individual products vary.
10,000 lines hold one generated EU personal-data value; 20,000 are the noise real repositories are full of: order numbers, timestamps, hashes, versions and amounts. Every value belongs to nobody.
Reports a value only when its own rules hold, or a keyword is nearby. Quiet by design.
Default analyzer with spaCy, scores of 0.5 and above. At any score it catches 81.6% of lines, with 12,236 false alarms.
Default scrubber: emails, phone numbers, cards, URLs, credentials and US social security numbers. No EU national identifiers.
| Identifiers all three claim to find caught / warnings that were real | Presidio | scrubadub | pii-eu |
|---|---|---|---|
| Payment cards | 80.6% / 37.8% | 0% / – | 88.5% / 98.4% |
| IBANs | 100% / 100% | not covered | 100% / 100% |
| Phone numbers | 44.4% / 100% | 61.1% / 4.4% | 84.9% / 100% |
| Email addresses | 100% / 100% | 100% / 100% | 44.9% / 100%, with a nearby keyword by design |
Where the others are ahead: Presidio and scrubadub report every email address; pii-eu reports contact data only next to a keyword such as email, so a codebase full of example addresses stays quiet. Turn that off with --min-confidence low.
Why pii-eu catches half: half of the values sit under a neutral name with no keyword, and bare numbers with a single check digit, such as Nordic and Baltic codes, stay quiet at the default level. With --min-confidence low --countries eea it catches 74.1%, with 786 false alarms and 90.4% of warnings real.
Measured on 30 October 2026 on one Apple laptop, each tool's own defaults, scored per line: a flag on a labelled line is a catch, a flag on a clean line is a false alarm. Presidio's catches count any entity on a labelled line, which favours it. The corpus generator ships with pii-eu.
A privacy tool that leaks is worse than none, so it is built to hold nothing.
One static program with no network calls, no account and no telemetry. It runs on a laptop or your own CI runner.
Reports, logs and fingerprints show RO72 •••• 7559, never the full value. Full values print only to your terminal, and only when you ask.
Every value it was tested on is generated by its own test suite. No employer, client or real person's data, ever.
Each line of the data map names the file and line it came from, so a DPO can check it and an auditor can trust it.
SARIF, GitHub annotations, GitLab code quality, JSON, CSV and a self-contained HTML report.
Archives are opened with limits on size, entries and depth, so a crafted file can't exhaust the machine.
Saying this plainly is part of the product.
No. It gives you evidence and a draft data map. Purposes, legal bases, contracts and people's rights still need people.
Not always. Names and addresses have no built-in check, so it reports them only next to a label such as full_name. National IDs, IBANs and cards are where it is strongest.
No. It reads code, schemas, configuration and the files you point it at, such as exports and saved images, not running systems.
Text in any language. Log calls in Go, Python, JavaScript and TypeScript, Java, Kotlin, Ruby and PHP. SQL schemas and ORM models, CSV, JSON Lines, archives, saved container images and Terraform.
Not yet. pii-eu is in preview with a small group of early partners, and ships inside Clause Eight.
For privacy and engineering teams in EU companies that build their own software: fintech, health, retail and SaaS.
Run pii-eu on two repositories and their test data, on your own machines.
Go through the findings with your DPO, set a baseline and replace real data in test files.
A draft data map for your record of processing, and the check running on every change.
Success looks like: no real personal data left in test files, a data map your DPO recognises, and new personal data caught before it ships.
Your DPO, security lead and auditor read the reports too, so you never count heads. pii-eu is sold on its own; Clause Eight customers already have it.
An engineering team that wants personal data out of its code, test data and logs.
€290€290a month
Billed monthly, cancel any time
Up to 10 repositories
fix for test data, baselines, pre-commitA DPO who needs the record of processing to match the software, every release.
€690€690a month
Billed monthly, cancel any time
Up to 50 repositories
Everything in Team, plusGroups, banks and health providers with many systems or no internet on build machines.
From €12,000a year
Annual contract
Unlimited repositories
Everything in Privacy, plusRun pii-eu on your clients' systems, on their machines, and hand over one self-contained report per client.
€390per client report
€4,900a year, unlimited client reports
| Feature | Team | Privacy | Enterprise |
|---|---|---|---|
| Finding | |||
| Repositories | 10 | 50 | Unlimited |
| Every detector, confirmed by its own rules | ✓ | ✓ | ✓ |
| Personal data in logs, error trackers and analytics | ✓ | ✓ | ✓ |
| Exports, dumps, archives and container images | – | ✓ | ✓ |
| Fixing | |||
fix for test and fixture files | ✓ | ✓ | ✓ |
| Baseline, pre-commit and CI templates | ✓ | ✓ | ✓ |
| Evidence | |||
| SARIF, GitHub, GitLab code quality, JSON | ✓ | ✓ | ✓ |
| Inventory and data map, map compared on every change | – | ✓ | ✓ |
| Art. 9, erasure and retention checks | – | ✓ | ✓ |
| HTML evidence report | – | ✓ | ✓ |
| Contract | |||
| Runs on your machines, no network calls | ✓ | ✓ | ✓ |
| Offline licence file | – | – | ✓ |
| Data processing agreement | Standard | Standard | Agreed with you |
| Support | Standard | Priority | Service level agreement |
Every plan starts with four weeks of early access: €900, credited against your first year if you stay.
Already a Clause Eight customer? pii-eu is included in every Clause Eight plan, with its findings mapped to the GDPR and PCI DSS.
Prices exclude VAT. Extra repositories are €20 a month each. Prices are for the preview and may change before release.
Pick two systems. In four weeks you'll have a data map drafted from the software and a check that keeps it current.
contact@clauseeight.eu