> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/pii-scan.md). # PII scan SaaS data loss prevention is one of the biggest challenges organizations face today. Employees can routinely share personally identifiable information (PII) in SaaS apps. DoControl uses natural-language processing (NLP) to provide near real-time scanning and classification for sensitive data types, such as PII, across all files stored in your SaaS applications. #### What does a PII scan look for and what does it return? A PII scan uses an external probability engine to detect the probability that a file includes predefined labels. You can search for a specific set (up to 33) of predefined labels, such as credit card details and social insurance numbers. You need a file with a critical mass of data to initiate a PII scan. Files which contain a small amount of text data might result in inaccurate results or false findings. A PII scan returns the probability as a percentage that an exact match was found. #### **When to use a PII scan?** We recommend you use a PII scan when you're not 100% sure about the spelling of the search items. For example, if you're looking for any password that varies between possible patterns, it's best to use an engine that will give you a probability estimate you can rely on. You can scan text-based files for PII in these apps: * [Google](#google-pii-scan) * [Slack](#slack-pii-scan) * [Slack Enterprise](#slack-enterprise-pii-scan) * [Zoom](#zoom-pii-scan) * [OneDrive](#onedrive-pii-scan) * [SharePoint](#sharepoint-pii-scan) * [Jira Software](#jira-pii-scan) {% hint style="info" %} Learn more about setting up a PII scan with [DoControl videos](/docontrol-user-guide/help/videos.md#pii-file-scanning). {% endhint %} ## How does PII scanning work? The PII scanning mechanism is based on an NLP service that uses machine learning concepts. You can select which [PII labels](/docontrol-user-guide/system-management/settings/legal-consent-for-pii.md) (for example, PASSWORD, PIN, EMAIL) to scan. The execution output shows for each label: * **Probability** - The probability between 0 and 1 (0%-100%) that the finding matches the label. * **Recommended threshold** - The recommended threshold to consider with high certainty that the finding contains PII for each selected label. These recommendations are based on DoControl data science research to optimize the PII findings.

{% hint style="info" %} **Note**: * The DoControl PII scanning module is based on an external NLP engine that scans for PII patterns. NLP engines are probability-based and might provide skewed results based on the number of labels and content structure. * As a general best practice: Use the finding probabilities and recommended thresholds, and avoid unnecessary PII labels. Increasing the number of scanned PII labels might increase the inaccuracy rate. * Maximum file size for running a PII scan is 10 MB. * Currently we support PII scanning in English only. {% endhint %} ## Enable PII scanning For your organization to use the PII file scan action, you must first provide [legal consent](/docontrol-user-guide/system-management/settings/legal-consent-for-pii.md). {% hint style="info" %} Once enabling the PII scan, this option remains enabled permanently. To disable it, send an email to . {% endhint %}

#### To provide legal consent for PII scanning: 1. From the DoControl side menu, click **Settings** > **Admin** > **Legal consent.** 2. From **Scan for Personal Identifiable Information (PII)**, click **Approve** **PII scanning.** 3. After enabling PII scanning, you can set workflows to scan for PII, and when found, you can prevent sharing of such information. ## PII patterns DoControl detects these PII patterns:


BANK ACCOUNT NUMBER	BANK ROUTING
CREDIT DEBIT NUMBER	CREDIT DEBIT CVV
CREDIT DEBIT EXPIRY	PIN
EMAIL	ADDRESS
NAME	PHONE
SSN	DATE TIME
PASSPORT NUMBER	DRIVER ID
URL	AGE
USERNAME	PASSWORD
AWS ACCESS KEY	AWS SECRET KEY
IP ADDRESS	MAC ADDRESS
LICENSE PLATE	VEHICLE IDENTIFICATION NUMBER
NATIONAL INSURANCE NUMBER (UK)	SOCIAL INSURANCE NUMBER (CANADA)
INDIVIDUAL TAX IDENTIFICATION NUMBER (US)	UNIQUE TAXPAYER REFERENCE NUMBER (UK)
PERMANENT ACCOUNT NUMBER (INDIA)	NREGA (INDIA)
INTERNATIONAL BANK ACCOUNT NUMBER	SWIFT CODE
NATIONAL HEALTH SERVICE NUMBER (UK)	HEALTH NUMBER (UK)
AADHAAR (INDIA)	VOTER NUMBER (UK)
VOTER NUMBER (INDIA)

## Supported file types DoControl supports these files types when running a PII file scan query:

App	File type	Supported MIME type
General	TXT (text) CSV (comma separated values) TSV (tab separated values) PDF (portable document format)	text/plain text/csv text/tab-separated-values application/pdf
Google Drive	GDOC (Google Docs) GSLIDES (Google Slides) GSHEET (Google Sheets)	application/vnd.google-apps.document application/vnd.google-apps.presentation application/vnd.google-apps.spreadsheet
Microsoft	DOCX (Word version 2007 and up) XLS (Excel up to version 2003) XLSX (Excel version 2007 and up), XLT PPTX (Powerpoint version 2007 and up)	application/vnd.ms-excel application/vnd.openxmlformats-officedocument.spreadsheetml.sheet application/vnd.openxmlformats-officedocument.wordprocessingml.document application/vnd.openxmlformats-officedocument.presentationml.presentation

## Google PII scan You can define a workflow to scan Google assets for personally identifiable information (PII), such as bank account details, PIN code, AWS keys, tax identification number (US), national insurance number (UK), and more. If found, you can add actions to prevent external or public sharing of Google assets containing PII.

Running a scan for PII labels in a Google Drive asset

1. For the **App**, select Google Drive. 2. Select the relevant trigger. 3. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. 4. Click the action to open its settings. 5. The asset ID is automatically populated. 6. Select the specific **PII labels** to scan for. 7. For **Error handling**, choose the relevant option: * Break on failure and warning errors * Break on failure error only * Continue workflow 8. Add more actions to your workflow. ## Slack PII scan You can define a workflow to prevent PII file sharing in an external Slack channel.

1. For the **App**, select Slack. 2. Select the relevant trigger, for example, User shared sensitive files in external channels. 3. The trigger conditions are automatically populated: * **Asset type supports file scanning** - File type supports PII data scanning. * **Channel is external** - Slack channel is shared. 4. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * Asset ID is automatically populated. * Select the specific **PII labels** to scan for. * For **Error handling**, choose the relevant option. 5. Add a **Conditional** action to your workflow to verify if the file contains PII: * If **False** - Add an **End workflow** step. * If **True -** Add a **Delete** action to remove the shared file. ## Slack Enterprise PII scan You can define a workflow to prevent PII sharing of files and messages in a public Slack Enterprise channel.

1. For the **App**, select Slack Enterprise. 2. Select the relevant trigger, for example, User shared sensitive messages in public channels 3. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * Select the Slack entity to scan: Message or file * Select the specific **PII labels** to scan for. * For **Error handling**, choose the relevant option. 4. Add a **Conditional** action to your workflow to verify if the message contains PII: * If **False** - Add an **End workflow** step. * If **True -** Add a **Delete message** action to remove the shared message. ## Zoom PII scan The DoControl integration with Zoom allows your organization to detect and prevent sensitive data and files, such as personally identifiable information (PII), from being shared on Zoom cloud recordings. This functionality is unique to DoControl, and essential to data loss prevention (DLP). People tend to share sensitive information, such as user and password credentials, more easily by spoken word than written text. DoControl runs PII scanning on all text-based files associated with Zoom cloud recordings, such as chat, closed captions, and audio transcripts. These text files have a high probability of including PII, such as passwords, emails, and bank account details. If PII is detected, DoControl automatically notifies your security team so they can take appropriate action, and delete any sensitive files if necessary. ### Use cases The ability to run PII scanning on your organization's Zoom cloud recordings addresses a wide range of use cases: * Visibility and exposure of a full inventory of every individual user and cloud-based recording. * Automatic scanning of files for personally identifiable information (PII), and removal of unauthorized access to them. * Identification of vulnerabilities within cloud recordings and their associated settings (i.e. sharing status, passcode protection, participants listed in the meeting, download-ability, generated files (recording, audio, chat, transcript, etc.) * Governance of strong password protection for high-risk users. * Secure access to sensitive video recordings and text-based files. * Secure workflows that are future-proofed to mitigate the risk of data overexposure and exfiltration of Zoom data and files. * Automated notification to individual actors and security teams on policy violations or anomalies that present material risk to the business. ### Prerequisites for Zoom PII scanning DoControl scans for PII in Zoom cloud recordings within these text-based files: * Chat * Closed captions * Audio transcript {% hint style="warning" %} To run a PII scan on Zoom cloud recordings, you must make sure that closed captions, audio transcript, and chat are available to Zoom users. {% endhint %} When there are no text files to scan, the PII output displays this message: `NO_TXT_FILES_SCANNED` #### To run a PII scan on a Zoom recording text file: 1. For the **App**, select Zoom. 2. Select the relevant trigger, for example, Recording completed. 3. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * The Meeting UUID is automatically populated. * Select the specific **PII labels** to scan for. * For **Error handling**, choose the relevant option. 4. Add a **Conditional** action to your workflow to verify if the recording contains PII: * If **False** - Add an **End workflow** step. * If **True -** Add a **Notify in Slack** action to notify the SecOps team.

### Retrieve Zoom metadata After a Zoom recording has been uploaded to the cloud, you can retrieve a wide range of metadata about the recording, such as participants, generated files, and their sharing status. 1. From the **Actions** pane, select **Workflows > New workflow > From scratch**. 2. From the Events field, select **Zoom > Recording completed**. 3. Add condition macros to retrieve metadata about the recording, such as:


Get meeting UUID	Get meeting sharing status
Get host email	Get meeting participant email
Get meeting topic	Get participant name
Get meeting participant name	Is password protected
Get participant email	Is downloadable

With the recording completed webhook, you can retrieve Zoom metadata

## OneDrive PII scan You can define a workflow to scan OneDrive assets for PII, such as bank account details, PIN code, AWS keys, tax identification number (US), national insurance number (UK), etc. 1. For the **App**, select OneDrive. 2. Select the relevant trigger, for example, File uploaded. 3. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * Asset ID is automatically populated. * Select the specific **PII labels** to scan for. * For **Error handling**, choose the relevant option. 4. Add a **Conditional** action to your workflow to verify if the file contains PII: * If **False** - Add an **End workflow** step. * If **True -** Add a **Notify in Slack** action to notify the SecOps team.

Running a scan for PII labels in a OneDrive asset

## SharePoint PII scan You can define a workflow to scan SharePoint assets for PII, such as bank account details, PIN code, AWS keys, tax identification number (US), national insurance number (UK), etc. 1. For the **App**, select SharePoint. 2. Select the relevant trigger, for example, File uploaded. 3. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * Asset ID is automatically populated. * Select the specific **PII labels** to scan for. * For **Error handling**, choose the relevant option. 4. Add a **Conditional** action to your workflow to verify if the file contains PII: * If **False** - Add an **End workflow** step. * If **True -** Add a **Notify by email** action to notify the SecOps team.

Running a scan for PII labels in a SharePoint asset

## Jira PII scan DoControl can scan Jira issues for personally identifiable information (PII), such as a password or bank account details. You can create a workflow to scan Jira issue descriptions, comments and attachments for PII. If a PII term is detected, your organization can send automatic notifications to relevant actors to handle the event appropriately.

1. For the **App**, select Jira. 2. Select the relevant trigger, for example: * Issue created or issue updated * Comment created or comment updated 3. From the Actions pane, select **Query > PII scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * Issue ID is automatically populated. * Select the specific [sub-entity](#scanned-jira-sub-entities) to scan: * Summary and description * Comments * Attachments * Select the specific PII labels to scan for. * For **Error handling**, choose the relevant option. 4. Add a **Conditional** action to your workflow to verify if the Jira issue contains PII: * If **False** - Add an **End workflow** step. * If **True -** Add a **Delete** **issue** action to remove the issue. #### Scanned Jira sub-entities You can leverage the Jira PII action in DoControl to scan a single sub-entity in Jira, such as: * Description and summary, OR * Comments, OR * Attachments {% hint style="success" %} If you want to scan several Jira sub-entities in a single workflow execution, you need to connect a PII scan action to each Jira sub-entity. {% endhint %} DoControl scans Jira issues and comments for these sub-entities:

Event type	Sub-entity scanned
Issue created	Summary Description Any attachments in the issue (up to 10 MB)
Issue updated	Summary Description New attachments added to the issue (up to 10 MB)
Comment created	Comment content only
Comment updated	Comment content only

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/pii-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.