Term Glossary

Key terms used throughout Sylure. Understanding these concepts will help you navigate the platform and interpret results effectively.

Supported Personal Data Types

Detection Categories

Sylure detects 11 personal data types, grouped into 5 GDPR-aligned categories. Each type has its own regex patterns, contextual heuristics, and normalisation rules.

Contact details

• Email address — Full email addresses. Role mailboxes (noreply@, admin@, support@, etc.) and known ESP/transactional domains are filtered out. Bad TLDs (localhost, internal, test) are excluded.
• Telephone number — UK and EU phone numbers. Validated using libphonenumber-js. Supports formats with/without country code, with spaces, dashes, parentheses. Default region: GB, with fallback to 16 EU regions.

Identity

• Full name — Detected using contextual header matching (columns labelled "name", "full name", "employee name", "customer name", etc.) and pattern-based extraction.
• Date of birth — Detected via header context (DOB, date of birth, birth date, born, etc.) and date pattern matching.

Address & location

• Postcode — UK postcodes validated against a comprehensive outward district lookup table. Requires header context or structural proximity to reduce false positives.
• Postal address — UK addresses detected using a term dictionary (road, street, avenue, close, etc.) combined with structural patterns.

Financial identifiers

• IBAN — International Bank Account Numbers. Validated with checksum verification.
• Bank account details — UK sort code + account number pairs. Detected as pairs with header context.
• Payment card number — Credit/debit card numbers. Validated with Luhn algorithm.
• Card expiry — Card expiry dates detected alongside card numbers.

Government identifiers

• National Insurance number — UK NINOs matching the standard format (two letters, six digits, one letter). Header context required.

How Detection Works

The detection engine processes each file through a multi-stage pipeline that combines pattern matching with contextual analysis.

• Text is extracted from each file using format-specific extractors.
• Multiple regex patterns and contextual heuristics are applied simultaneously.
• Header/column labels provide context to reduce false positives (e.g. a column labelled "DOB" boosts date-of-birth detection confidence).
• Detected values are normalised (lowercased emails, E.164 phone numbers, uppercase postcodes, etc.).
• Values are hashed using HMAC-SHA256 with a per-installation secret key — raw values are never persisted.
• Evidence snippets are generated with automatic masking.

Risk Sensitivity Weights

Each personal data type carries a sensitivity weight that reflects its GDPR significance. Higher weights drive higher risk scores.

Risk Scoring Formula

Risk scores are computed using a deterministic formula that accounts for sensitivity, data combinations, and volume.

1. Base sensitivity — The highest sensitivity weight among all personal data types present.
2. Combination bonuses — Financial + Identity = +1.5; Financial + Contact = +1.0; Identity + Contact = +0.5.
3. Diversity bonus — 3+ distinct types = +0.5; 5+ distinct types = +0.5.
4. Volume context — Scales from 0.9× (under 10 items) to 3.0× (1M+ items).
5. Final score — (base + combos + diversity) × volume_context, clamped to max 7.0.
6. Banding — Score ≥ 7 = high; Score ≥ 3 = medium; else low. Exception: if financial or government data is present, minimum band is medium.
7. Normalised score — Mapped to 0–100 scale (max combined = 7 × 3.0 = 21).

Supported File Formats

Sylure supports the following file formats for text extraction and personal data detection.

Upload Constraints

• Maximum ZIP size: 3 GB (compressed).
• Maximum uncompressed size: 20 GB (guards against ZIP bombs).
• Maximum files processed per ZIP: 100,000.
• ZIP must have valid PK magic bytes (PK\\x03\\x04 or PK\\x05\\x06).
• Files not matching supported extensions are skipped silently.
• Password-protected or corrupt files are skipped with warnings (scan completes as COMPLETED_WITH_WARNINGS).

Upload & Scan Pipeline

Every bundle uploaded to Sylure passes through a multi-stage pipeline that validates, scans for malware, detects personal data, and materialises analytics summaries. The pipeline runs asynchronously — you can close the browser after upload.

Preparing Your Bundle

Collect exports from your systems and package them into a single ZIP file. The internal folder structure is preserved and used as the asset path in Sylure.

• Collect exports from your systems (CRM, payroll, support, finance, etc.).
• Package them into a single .zip file.
• Realistic examples: salesforce_contacts_export_2025-10-04.csv, payroll_extract_Q3_2025.xlsx, zendesk_tickets_2025-09.json, supplier_invoices_Oct_2025.pdf.
• The internal folder structure is preserved and used as the asset path.

Upload Process

1. Drag-and-drop or click-to-select on the Sources page.
2. Client computes SHA-256 hash of the file before upload (integrity verification).
3. Resumable multipart transfer (32 MB chunks) — if connection drops, it can resume.
4. Pipeline steps shown in UI: Hashing → Registering → Transferring → Queuing.
5. After upload, the scan is queued automatically — you can close the browser.

Scan Pipeline Stages

Failure states:

Scan Concurrency & Performance

• ZIP entries are processed with configurable concurrency (default 8 parallel).
• Database writes are batched with configurable concurrency (default 8).
• Progress is flushed every 5 seconds with heartbeat every 15 seconds.
• Scan job tracks stage (DOWNLOADING / VALIDATING / SCANNING / MATERIALIZING), bytes downloaded, metrics counters, and timing breakdowns.

Retry Failed Scans

Admin users can retry failed scans from the upload detail page. The system creates a new scan job for the existing upload, and only one scan job per upload runs at a time.

Monthly Upload Quota

Each organisation has a monthly upload quota measured in GB. Quota is tracked using a reservation system: bytes are reserved when upload starts, settled on completion, and released on failure. Quota resets on the billing cycle anniversary.

• Quota usage is displayed on the Sources page with a progress bar.
• Tiers: Starter/Partner = 10 GB/month; Professional = 50 GB/month; Enterprise = unlimited.

Dashboard & Overview

Dashboard Page /overview

The Dashboard provides a high-level risk overview for the organisation. It surfaces the most critical findings and gives you an at-a-glance understanding of your personal data exposure.

• Attention Queue: Top 5 high-risk findings with asset details, file path, and personal data types.
• Filters: Time range (7 days, 30 days, all time) and upload scope (specific upload or all).
• Risk tiles: Total findings, high/medium/low breakdown, risk mix percentages.
• AI Explainer: Optional AI-generated insight explaining the dashboard metrics.

Analytics Component

The dashboard fetches analytics data via API endpoints, all scoped to the user's organisation (multi-tenant isolation):

• /api/analytics/risk-summary
• /api/analytics/pii-composition
• /api/analytics/top-assets
• /api/analytics/pii-by-asset
• /api/analytics/pii-high-risk-by-type
• /api/analytics/monthly-delta
• /api/analytics/uploads-summary

Analytics & Reports

Analytics Page /analytics

The Analytics page provides detailed reporting with charts and data tables. Use it to build a comprehensive picture of your organisation's personal data landscape.

• Filters: Time range (7d, 30d, all) and upload scope.
• Risk summary tiles (overall risk score 0–100, risk label, total exposed personal data, high-sensitivity exposures, assets with personal data).
• Personal data composition chart (breakdown by type).
• Personal data by type with risk breakdown (how many of each type appear in high/medium/low risk assets).
• Top risky assets list (asset name, total hits, highest risk, personal data types present).
• File type breakdown (which extensions contain the most personal data).

AI Executive Summary

Generate a stakeholder-ready narrative summary of your risk profile. The AI receives only aggregate metrics — no raw personal data, no file contents, no identity values.

• Sends only aggregate-only data to the AI.
• Rate limited at the workspace level (monthly quota, depends on tier).
• Viewers can view existing summaries but cannot generate new ones.
• Downloadable as part of the report.

Report Export

Reports can be exported as HTML and include risk profile, personal data distribution, top risky assets, and upload/time filters.

Exposures

Exposures Page /exposures

The Exposures page lists all detected findings (personal data exposures) across all scanned uploads. Use it to triage and track the resolution of individual findings.

• Cursor-based pagination (15 items per page) for performance with large datasets.
• Filters: Search by file path, risk band (high/medium/low/all), status (active/resolved/all), upload scope.
• Each row shows: file path, personal data types found, risk band, status, creation date, upload source.

Finding Detail Page /exposures/[id]

Detailed view of a single finding showing risk band, exposure type, status, creation date, evidence (masked), examined bytes, personal data types with counts, asset info, and source info.

• Status management: Admin and Analyst can change finding status between active and resolved_removed.
• Identity hits viewer: shows all identity hits for the asset, with override management (Admin/Analyst can mark hits as IGNORED for false positives).

Finding Statuses

Discovery Tool (DSAR Search)

What the Discovery Tool Does

The Discovery Tool locates all personal data related to a specific data subject across all scanned uploads. Designed for DSAR (Data Subject Access Request) fulfilment under GDPR Article 15, it supports searching by any of the 11 detected identifier types.

How to Search

Start with one strong identifier — an email address or phone number works best. You can add up to 9 identifiers per DSAR bundle for multi-identifier search.

• Search is performed against HMAC-SHA256 hashes — the system never sees the raw value in transit.
• Results show matched identity hits with: source file, location (asset path), match type, confidence level, risk level, upload name, and masked evidence snippets.

Search Result Details

Each hit includes:

• Source — Upload name and file path.
• Match type — The identifier type that matched (email, phone, name, etc.).
• Confidence — exact_email, exact_phone, exact_name, exact_dob, exact_postcode, exact_address, exact_iban, exact_nino, exact_bank_pair, exact_card, possible_phone_last6, or other.
• Risk level — LOW, MEDIUM, HIGH, or UNKNOWN.
• Evidence — Masked snippet showing the context where the data was found.

DSAR Exports

• Export formats: Excel (.xlsx) and JSON.
• Exports include: structured results, masked evidence snippets, asset locations, upload references.
• Monthly export quota: Starter/Partner = 30/month; Professional = 90/month; Enterprise = unlimited.
• Quota is tracked at the organisation level and resets on billing cycle anniversary.

AI Discovery Draft

Generate an AI-drafted DSAR response letter based on the discovery results. Uses aggregate discovery data — no raw personal data is sent to the AI.

• Daily rate limit at the workspace level with cooldown between runs.
• Monthly quota: Starter/Partner = 30/month; Professional = 90/month; Enterprise = unlimited.
• Draft output for human review — always review before sending to the data subject.

Subject Profile & Journey

The Discovery Tool builds a subject profile including known identifiers, first/last seen dates, total uploads and assets where the subject appears, systems map, timeline, and risk signals.

Sources / Uploads

Sources Page /uploads

The Sources page lists all uploads for the organisation with status, size, creation date, and completion date.

• Filters: Search by filename, status filter (All, In Progress, Completed, Failed, Expired, Deleted).
• Cursor-based pagination with page stack navigation.
• Auto-refresh: polls for status updates on in-progress uploads.
• ClamAV health badge shows antivirus engine status.

Upload Detail Page /uploads/[id]

Detailed view of a single upload showing filename, status, size, storage key, creation/completion dates, error details, event timeline, scan job details, and available actions (Retry, Download raw, Delete/Purge).

Upload Lifecycle Events

Settings & Workspace Management

Overview

Admin-only page for workspace management, accessed via the sidebar. Uses a tabbed interface.

Organisation Settings

View organisation name, data region (e.g. eu-west-2), and retention configuration.

• Retention policy: raw bundles retained for 30 days (configurable via S3 lifecycle).
• Storage info: where raw files are stored, lifecycle policy source.

Member Management

• Add new members with email + role assignment.
• Edit existing members: change role, deactivate/reactivate, force password reset.
• Roles: ADMIN, ANALYST, VIEWER (see Roles & Permissions section).
• Account lockout: after too many failed login attempts, account is temporarily locked.

Retention & Deletion

Manage data lifecycle through soft delete (grace period) and hard purge (immediate irreversible deletion). All derived outputs are cascade-deleted: findings, assets, identity hits, discovery evidence, cached analytics, and AI explainer caches.

• View scheduled deletions and recent purges.
• Grace period is configurable.
• Deletion counts: scheduled for deletion, purged in last 30 days.

Audit Log

A chronological, tamper-evident log of all audited actions in the workspace. Each entry records timestamp, actor, action, outcome (SUCCESS/FAILURE/DENIED), target, IP address, user agent, path, and method.

• Tracked events: Authentication (login success/failure), exports, raw bundle downloads, member/role changes, upload lifecycle events, DSAR searches, AI feature usage.
• Exportable as Excel (Admin only).
• Metadata field contains additional structured context (never includes secrets).

Support Form

In-app support request form, accessible from Settings.

Architecture & Infrastructure

Sylure runs entirely within AWS eu-west-2 (London). The architecture is designed for security isolation, with separate layers for edge routing, application logic, and data storage.

System Architecture

Requests flow from the browser through Cloudflare's WAF and CDN, into an Application Load Balancer, and into ECS Fargate containers running the Next.js application. ClamAV runs as a sidecar container for antivirus scanning. Data is stored in Neon (managed PostgreSQL), S3 for raw bundles, and SSM Parameter Store for secrets.

Upload & Scan Pipeline

The upload pipeline starts client-side with SHA-256 integrity hashing, proceeds through presigned S3 multipart upload, then flows through validation, ClamAV scanning, PII detection, and analytics materialisation.

Deployment Pipeline

Code pushed to the main branch triggers GitHub Actions for linting, testing, and Docker image build. The image is pushed to ECR and deployed to ECS Fargate via rolling update.

Data Security Model

Security is enforced across three layers: TLS and WAF at the browser layer, authentication and RBAC at the application layer, and HMAC hashing with encryption at rest at the data layer.

Roles & Permissions

Sylure uses role-based access control with three roles: Admin, Analyst, and Viewer. Each role grants a specific set of capabilities following the principle of least privilege.

Role Matrix

Why Buttons May Be Disabled

Two reasons:

1. Role doesn’t permit the action.
2. Organisation-wide quota has been reached. Quota resets on billing cycle anniversary.

Security & Trust

Security is foundational to Sylure. Every layer of the platform — from upload through storage to deletion — is designed to protect personal data and maintain audit-ready compliance. See the Data Security Model diagram for a visual overview of how these controls are layered.

Data Security

• Hashing: All personal data values are stored as HMAC-SHA256 hashes, not raw text. The hash secret is per-installation.
• Evidence masking: All evidence snippets are masked by default in UI and exports. Masking functions exist for every personal data type.
• Antivirus: Every uploaded bundle is scanned by ClamAV before processing.
• ZIP validation: Magic byte verification, size limits (3 GB compressed, 20 GB uncompressed), ZIP bomb protection, file count limits (100,000).
• Multi-tenant isolation: All data is scoped to an organisation via orgId. Database queries always filter by org.
• Session security: Sessions use 48-byte random hex tokens, stored in PostgreSQL. Default TTL: 8 hours (30 days with "remember me"). Sessions are validated on every request.
• Password security: Passwords are hashed using scrypt with random 16-byte salt. Timing-safe comparison to prevent timing attacks.
• Account lockout: Failed login attempts are tracked. Accounts are temporarily locked after too many failures.
• Rate limiting: Login attempts are rate-limited by IP, email, and IP+email combination. Database-backed rate limiter.
• CSRF protection: Session cookie with secure attributes.
• Input validation: All user inputs are sanitised for PostgreSQL storage (null bytes removed, surrogate pairs stripped, length limits enforced).

Storage & Region

• Raw bundles stored in AWS S3, region eu-west-2 (London).
• S3 lifecycle policies enforce automatic deletion after configured retention period.
• Multipart upload support with presigned URLs for direct S3 transfer.

Audit Trail

Every significant action creates an audit log entry with actor, action, outcome, target, IP, user agent, and structured metadata. The audit trail is tamper-evident and exportable as Excel for compliance reviews.

• Outcomes: SUCCESS, FAILURE, DENIED.
• Exportable as Excel for compliance audits.

Retention & Deletion

Sylure implements a two-layer deletion model: product-level (soft delete + purge) and storage-level (S3 lifecycle backstop).

• Raw bundle lifecycle: configurable retention (default 30 days via S3 lifecycle).
• Derived data retention: user-controlled (persists until user deletes).
• Prepared but unscanned uploads expire after 24 hours.
• Deletion cascade: raw file → findings → assets → identity hits → analytics summaries → AI caches.

AI Features

Overview

Sylure uses AI (powered by Claude, Anthropic) for two features: Dashboard/Analytics explainers and DSAR response drafts. The AI integration is designed with a privacy-first approach — only aggregate, statistical data is ever sent to the model.

All AI output is labelled as "draft output for human review".

AI Explainers (Dashboard & Reports)

AI-powered explanations are available in four contexts:

• Dashboard Risk Tiles — Explains the risk profile metrics (total findings, risk mix, trend direction).
• Top Risky Assets — Explains which assets are driving risk and why.
• Personal Data by Type — Explains the distribution of personal data types and their risk implications.
• Reports Executive Summary — Full narrative summary including overview, top assets, risk distribution, personal data by type, personal data by file type.

AI Discovery Draft

Generates a DSAR response letter based on discovery results, including a summary of data found, systems/uploads where data appears, and risk assessment. Subject to daily rate limits per workspace with cooldown between runs.

Quotas & Limits

• AI features consume organisation-level monthly quotas.
• Quotas reset on billing cycle anniversary.
• Daily caps prevent runaway usage.
• Cooldown periods prevent accidental re-runs.
• Viewers cannot generate AI content (can only view cached results).
• Quota indicator shown in the UI when approaching or at limit.

Caching

AI explanations are cached per organisation, scoped by context type, range, and upload scope. The "Show" operation returns the cached result without consuming quota, while "Generate" forces a new generation and overwrites the cache.

• Cache key: orgId + scopeKey (includes context type, range key, upload scope).

Pricing & Quotas

Sylure offers four pricing tiers designed to scale from small consultancies to large enterprises. All tiers include the full platform — the difference is capacity, quotas, and support level.

Pricing Tiers

Add-ons: Extra user = £30/month · Extra storage = £10/GB

Feature Comparison by Tier

Capacity

AI Features

Exports

Security

Support

Frequently Asked Questions

Navigation Reference

Sidebar Navigation (Authenticated App)

Marketing Site Pages

Support & Contact

Sylure provides tiered support based on your pricing plan. All tiers include an onboarding call to help you get started, and in-app support is always accessible from the Settings page.

• Email: sylure@sylure.com
• Support SLA depends on pricing tier (48hr for Starter/Partner, 24hr for Professional, Dedicated for Enterprise).
• All tiers include an onboarding call.
• Enterprise tier includes security questionnaire support and DPA negotiation.
• In-app support form available from Settings page.
• Feedback: Use thumbs up/down on any page.