Find where the data lives, which laws apply, and what to ask for.
Privatrol looks at an organisation from the outside, using public sources only. It finds where its mailboxes, files, mail gateways and hosting are kept, checks each place against the privacy laws of 91 jurisdictions, and tells you which document to ask for. It also finds everything else an outside view can see: the attack surface, breaches, people, corporate structure and the companies it depends on.
Public sources only · every query through a VPN exit · runs on your own server · free, by invitation · made in Canada
From a company name to a list of questions
Privacy and vendor reviews usually start from a questionnaire the other side filled in. Privatrol starts from what can be seen without asking.
Where the data lives
It reads where Microsoft 365 mailboxes, SharePoint and OneDrive sit, where mail filtering and mail senders are, and which cloud regions the hosting is in. Each place says how sure it is. What is measured
Which laws apply
It works out where the organisation operates, from the operator's input, company registries, Wikidata, country domains and job postings, and checks each location against the law data. Laws covered
What to ask for
Each finding names the law and the citation, and the document to ask for: a transfer assessment, contract clauses or a data-region setting. It never claims to have seen a contract.
What a finding looks like
This is a made-up organisation, shown to explain the layout. Each place data was found has a confidence. Each finding names the law, says how serious a gap it could be, and says what to ask for.
- Mailboxes are counted only when two VPN exits in different Microsoft geographies agree
- A location read from one weak signal is capped at a medium finding
- The service identified but not locatable is reported as unknown, never guessed
Where the data lives
What to ask for
Personal information may leave Quebec for hosting in us-east-1, which needs a documented assessment first.
Ask for: the s. 17 privacy impact assessment and the written agreement with the host.
Hosting in the United States is a transfer that needs a safeguard.
Ask for: the transfer mechanism in use: the host's data privacy framework certification, or the contract clauses.
Residency is the lead. The rest of the outside view is still here.
The same dive that locates the data maps everything else an organisation shows the internet.
Attack surface
Subdomains, hosts, certificates and exposed services.
Breaches and stealer logs
Where the organisation's addresses and accounts have turned up in leaks.
People and email
Who works there, which addresses are exposed, and how they could be reached.
Corporate structure
Subsidiaries, parents and acquisitions, so no domain is missed.
Fourth parties
Who the company depends on, and what those suppliers depend on.
CVEs, graph and report
Known vulnerabilities in what is exposed, an entity graph, and an executive report.
Your server, your egress
Privatrol is a tool for looking at other organisations, so it is built to keep your own address out of it.
Self-hosted
It runs on a server you control, and what it collects is stored there.
Fails closed
Every query goes out through a VPN exit. If the tunnel is down, queries stop; nothing leaves from your own address.
Passive by default
It reads public sources. An active check is made only with the target's written permission.
Questions people ask first
Is a finding a breach?
No. Every finding is a potential issue seen from the outside. Privatrol cannot see contracts, so each one names what to ask for and leaves the conclusion to the people who can read the paperwork.
Is this legal advice?
No. The law data is checked periodically, cites its sources and states a confidence, but it is not legal advice. See the coverage.
Can it tell where Google Workspace data is kept?
Not from outside. It reports the service as unknown, and where a law requires in-country storage it says the location cannot be confirmed and asks for the data-region setting.
How do I get it?
Privatrol is free, by invitation only. Request an invitation.
Need to know where an organisation's data lives?
Privatrol is free, by invitation only.