ATO, Clause Eight's EU personal-data scanner, finds national ID numbers, IBANs, cards, contact and health data in your code, test files, logs and exports, proves each match with the identifier's own rules, and drafts your GDPR record of processing from the software itself.
Supporting evidence for your record of processing, not legal advice. Found values are masked in every report.
The record of processing is a spreadsheet filled in from interviews, while the software keeps changing underneath it.
The data protection officer asks each team what they store. The answers are out of date the week after, and nobody can show where a line came from.
A real customer's ID copied into a test file, an email address written to a log, an export left in a shared folder. Nobody meant it, nobody noticed.
Many scanners check only a few EU national IDs, and few look in code before it ships. Pattern searches flag every 13-digit order number, and after a few hundred false alarms nobody reads the report.
ATO runs where your files already are, on a laptop or in CI, and nothing it reads leaves the machine.
Code, test files, logs, CSV and JSON exports, archives and saved container images, read in one pass. Each value is masked the moment it is found.
Most identifiers carry their own proof: a check digit, a date of birth, a region code. ATO redoes that arithmetic, so an order number with the same shape is left alone.
Schemas, models and Terraform become an inventory: which store holds which personal data, who receives it, and whether it can be erased.
On every change, the map is compared with the last release. A new kind of personal data, or a new outside company receiving it, is held until someone approves it.
order_id 5034172093861 has the same shape, but month 41 doesn't exist| Store | Personal data | Source |
|---|---|---|
| users PostgreSQL | National ID, email, phone | db/schema.sql:14 |
| patients PostgreSQL | Health data Art. 9 | migrations/0007.sql:4 |
| app logs CloudWatch | Email, via log.info | checkout/notify.py:13 |
| exports S3 · eu-central-1 | Customer CSV, encrypted | infra/s3.tf:3 |
| Stripe outside company | Name, card | billing/charge.py:21 |
patients.diagnosis holds health data (GDPR Art. 9). The record of processing needs a purpose and a legal basis before this ships.ato map --diff · supporting evidence, not legal adviceThree open-source shops, 3,000 EU identifiers hidden in their fixtures, migrations and tests, and three scanners at their default settings.
Both left alone every harmless lookalike: a length, a verified flag, a masked value, an ID. In a second test across eight languages, ATO caught 160 of 160 and HoundDog 60 of 160, with nothing found in Kotlin, PHP, Ruby or TypeScript.
Presidio reports every email and every card number, so it catches more of those two, and pays for it with thousands of alarms: most emails in code are fake, and most card-shaped numbers under id or ref are IDs.
Fixtures, migrations, seeders and tests of Saleor, Bagisto and Solidus, plus an application log: 96,365 lines with 3,000 generated EU identifiers inserted. Every tool at its defaults; Presidio without its prose recognisers. Means of three runs, 31 October 2026. On a fully generated 30,000-line corpus: ATO 57.7% caught and 99.8% real, Presidio 35.4% and 51.7%.
Engineers set it up once. Privacy, security and audit read what it finds, each in their own terms.
Instead of interviews: every field that holds personal data, where it is stored and who receives it.
The leaks that turn into incidents: logs, dumps, buckets and images.
Quiet by design: few warnings, and the ones you get are real.
One self-contained report per system, run on the client's own machines.
Inside Clause Eight. ATO runs as one of Clause Eight's scanners, and its findings become evidence for the GDPR and, for card data, PCI DSS, next to everything else Clause Eight collects.
It keeps a scanner's speed and gives the privacy team the record they actually need.
| What you need | Generic PII scanners | A hand-kept record | ATO |
|---|---|---|---|
| Finds EU national ID numbers | A few EU identifiers | Only what people remember | 26 EU states by default, 31 countries in all, each by its own rules |
| Tells real data from lookalikes | Pattern matches, many false alarms | Not applicable | Check digits, dates and region codes |
| Drafts the Art. 30 record | No | Yes, by interviews | From schemas, models and Terraform, with file and line |
| Finds personal data in logs and analytics | Rarely | No | Log, error-tracker and analytics calls |
| Stays current | Per scan | Once a year | Compared on every change |
| Keeps your data in house | Cloud tools copy it out | Yes | One program, no network calls |
Typical capabilities by category; individual products vary.
Shown for planning while ATO is in preview: it is not for sale yet, and prices may change before it is. Your DPO, security lead and auditor will read the reports too, so you never count heads.
An engineering team that wants personal data out of its code, test data and logs.
€390€390a month
Planned price, not on sale yet
Up to 10 repositories
fix for test data, baselines, pre-commitA DPO who needs the record of processing to match the software, every release.
€990€990a month
Planned price, not on sale yet
Up to 50 repositories
Everything in Team, plusGroups, insurers and health providers with many systems or no internet on build machines.
From €18,000a year
Planned, annual contract
Unlimited repositories
Everything in Privacy, plusRun ATO on your clients' systems, on their machines, and hand over one self-contained report per client.
€590per client report, planned
€7,900a year, unlimited client reports, planned
| Feature | Team | Privacy | Enterprise |
|---|---|---|---|
| Finding | |||
| Repositories | 10 | 50 | Unlimited |
| Every detector, confirmed by its own rules | ✓ | ✓ | ✓ |
| Personal data in logs, error trackers and analytics | ✓ | ✓ | ✓ |
| Exports, dumps, archives and container images | – | ✓ | ✓ |
| Fixing | |||
fix for test and fixture files | ✓ | ✓ | ✓ |
| Baseline, pre-commit and CI templates | ✓ | ✓ | ✓ |
| Evidence | |||
| SARIF, GitHub, GitLab code quality, JSON | ✓ | ✓ | ✓ |
| Inventory and data map, map compared on every change | – | ✓ | ✓ |
| Art. 9, erasure and retention checks | – | ✓ | ✓ |
| HTML evidence report | – | ✓ | ✓ |
| Contract | |||
| Runs on your machines, no network calls | ✓ | ✓ | ✓ |
| Offline and air-gapped machines | – | – | ✓ |
| Support | Standard | Priority | Agreed with you |
Early access will come first: four weeks on two of your systems, before anything is sold.
With Clause Eight: ATO is planned to be included in every Clause Eight plan, with its findings mapped to the GDPR and PCI DSS.
Planned prices, excluding VAT; extra repositories €30 a month each. Nothing is for sale during the preview.
A privacy tool that leaks is worse than none, so it is built to hold nothing.
One static program with no account and no telemetry. It runs on a laptop or your own CI runner, and works with networking turned off: check it yourself.
Reports, logs and fingerprints show RO72 •••• 7559, never the full value. Full values print only to your terminal, and only when you ask.
Every value it was tested on is generated by its own test suite. No employer, client or real person's data, ever.
Each line of the data map names the file and line it came from, so a DPO can check it and an auditor can trust it.
SARIF, GitHub annotations, GitLab code quality, JSON, CSV and a self-contained HTML report.
Archives are opened with limits on size, entries and depth, and git never runs commands from the folder being scanned.
Saying this plainly is part of the product.
No. It gives you evidence and a draft data map. Purposes, legal bases, contracts and people's rights still need people.
No. Names and addresses have no check digit. Name and address detection is off by default and, when switched on, reports them only next to a label such as full_name. National IDs, IBANs and cards are where it is strongest.
No. It reads code, schemas, configuration and the files you point it at, such as exports and saved images, not running systems.
Text in any language. Log calls in Go, Python, JavaScript and TypeScript, Java, Kotlin, Ruby and PHP. SQL schemas and ORM models, CSV, JSON Lines, archives, saved container images and Terraform.
Not yet. ATO is in private preview and not for sale. It will be sold on its own and as part of Clause Eight.
ATO is in private preview and not for sale yet. Early access will be for privacy and engineering teams in EU companies that build their own software: health, HR and payroll, insurance, education and SaaS.
Run ATO on two repositories and their test data, on your own machines.
Go through the findings with your DPO, set a baseline and replace real data in test files.
A draft data map for your record of processing, and the check running on every change.
Success looks like: no real personal data left in test files, a data map your DPO recognises, and new personal data caught before it ships.
A data map drafted from your software, and a check that keeps it current. In private preview now.
In private preview, not for sale yet.