Data Risk Audit

Every file is a potential risk.
Measure it.

APOLLO Data Auditor scans files, databases, and cloud. You get your financial exposure in euros and dollars — not an abstract score.

12 connectors
44 types PII
Zero data exfiltration
Native packaged binary
87 scores
Privacy Risk
€2.0M estimated GDPR exposure
Art. 9
€1.56M
Art. 6
€340K
Encrypted
11%
6.6K
files with PII
55/100
compliance score
59
toxic combinations
$1.5M
CCPA exposure
The problem

You don't know what you're holding.

But a regulator or a breach will find it.

GDPR fines

4% of revenue

or EUR 20M per infringement. Whichever is higher applies — Art. 83 GDPR.

European Commission, GDPR Art. 83

CCPA penalties

$7,988

per violation, no cure period. Statutory damages $100–$750 per affected person.

CPPA enforcement actions, December 2024

EU AI Act fines

€35M

or 7% of global annual turnover for providers of prohibited AI systems. Whichever is higher applies — Art. 99 EU AI Act.

European Commission, EU AI Act Art. 99

Cost of an SMB breach

$3.31M

for companies with fewer than 500 employees. 68% of breaches involve a human factor.

IBM/Ponemon 2025 · Verizon DBIR 2025

35% of companies don't know where their sensitive data is. (Forrester, State of Data Security, 2025)

How it works

3 steps. A few hours. Zero consultants.

1

Install

A native packaged binary (PyInstaller), installed in minutes by your internal IT on Windows or Linux. No dependencies, no server. Your data never leaves your infrastructure.

2

Scan

12 connectors: PostgreSQL, MySQL, MariaDB, MongoDB, SQL Server, OneDrive, SharePoint, Active Directory/LDAP, Pennylane (ERP), local files, NFS/SMB shares. 44 PII types detected automatically.

Up to 1.16M rows/s
3

Decide

Clear score, financial exposure in EUR and USD, prioritized action plan with impact. You decide with full knowledge.

4 modules

What you get

Each tab covers a specific topic.

Privacy Risk

Your GDPR and CCPA financial exposure quantified in euros and dollars. Not an abstract score: a precise amount with regulatory articles and corrective actions.

  • PII Map: 44 types × 4 sources
  • Risk Matrix: exposure by type × source
  • Toxic combinations detected automatically
  • Breach impact simulation with regulatory timeline
  • Deterministic report with action plan P1→P3
  • Cyber Insurance Readiness: 8 cyber controls scored + declarative questionnaire

Compliance Risk

Where you stand article by article. Not a declarative checklist — automated scoring based on your scanned data.

  • GDPR score by article: Art. 5, 6, 9, 30, 32, 83
  • CCPA, NIS2, SOC 2 Type II, DORA scored A–F (CCPA and SOC 2 via integrated questionnaire)
  • Art. 30 register generated automatically
  • Remediation plan P1→P3 — regulatory article on each action
  • AI Act Art. 99 — exposure up to €35M / 7% revenue
  • Breach Simulations — 72h EDPB timeline

Protection Risk

Full inventory of what you store, how it's protected, and what happens when things go wrong. Infrastructure, backup, and disaster scenarios — measured, not guessed.

  • Agnostic — works with any backup solution, software or hardware
  • Infrastructure audit: hardware, OS, RAID, SMART, backup agents
  • Backup assessment: 10-question evaluation, resilience scoring
  • Data Protection Simulations: 5 disaster scenarios simulated (ransomware, server crash, accidental deletion, cloud loss, full disk)
  • Quantified recovery costs: forensics, downtime, operational losses
  • Encryption posture and access surface by source

Quality & AI

Assess the quality and maturity of your data for AI projects. AI Readiness scores and EU AI Act pre-compliance.

  • AI Readiness Score (infrastructure, quality, governance)
  • Data Quality: completeness, uniqueness, validity, timeliness
  • Governance: 6 KPIs per table
  • Data Lineage (views, triggers, procedures)
  • EU AI Act Art. 11 pre-compliance

Summary view — The Summary view calculates in real time the impact of your priority actions: if you address P1 actions this week, what will your compliance grade be — and what does inaction cost you?

Calculated on your actual parameters — Enter your revenue, company size and sector. Financial exposures are calculated on your actual parameters — not the theoretical maximum. Benchmarks regularly updated from official GDPR, CCPA, NIS2 and AI Act texts and published enforcement decisions.

Performance

How fast is APOLLO Data Auditor?

Native packaged binary (PyInstaller), zero runtime dependencies. Benchmarks validated on OVH infrastructure, January 2026.

several
TB scanned
218M
rows analyzed
31.5M
PII detected
100%
success rate
SourceThroughputVolume tested
SQL Server1,160,000 rows/s21.2M rows
PostgreSQL801,000 rows/s59.3M rows
MySQL527,000 rows/s37.7M rows
MongoDB478 000 docs/s100M docs
Local files43–171 files/s284K files
Cloud SharePoint118.6 files/s71K files
Pennylane (ERP)API connectoraccounting data
Why Data Auditor

360° data risk audit, measured and quantified in € — across 4 axes

Where others declare (questionnaires), scan a single perimeter (cloud-only or backup-bundled), or charge 6 figures. APOLLO Data Auditor measures all 4 axes (Privacy · Compliance · Protection/Resilience · Data Quality & AI) at SMB pricing.

Deploy in minutes

Minutes

Not 4 to 6 weeks. No consultant. One binary, one API key, you're up.

Quantified exposure

EUR & USD

A precise amount in euros and dollars. Not an abstract red/orange/green score.

The fastest

1.16M rows/s

Native packaged binary. Published and verifiable throughputs. No competitor publishes theirs.

Where others don't go

Local-first

Cloud DSPMs don't read local files. APOLLO Data Auditor scans file servers, application servers, databases — the on-premise perimeter cloud-only solutions cannot reach.

Zero data exfiltration

0 bytes

Your data never leaves your infrastructure. Only metadata is transmitted.

SMB pricing

< EUR 5,000/yr

The same insights as enterprise solutions — at a fraction of the cost.

Market positioning

3 approaches to data risk — 4 axes

Declarative, single-perimeter, or 360° measured. APOLLO Data Auditor covers all 4 axes Privacy · Compliance · Protection/Resilience · Data Quality & AI at SMB pricing.

Declarative approach
Questionnaires
Consulting firms · GRC register platforms
Point-in-time · non-repeatable · no real scan
Single-perimeter solution
$50K – 500K+/yr
Cloud-only DSPM or backup-bundled enterprise module
Single perimeter covered · 4–6 weeks deployment

Privacy Risk

Measured, not estimated
The market Ad-hoc consulting audits based on declarations, or cloud-only Enterprise DSPM with no enterprise server coverage.
APOLLO Data Auditor Calculates GDPR, CCPA and NIS2 fines article by article in € and $. Scans files, databases, cloud, Windows / Linux / macOS arm64 endpoints. Breach Simulation: 5 quantified scenarios.

Compliance Risk

Scored, not declared
The market GRC and Privacy Governance tools based on declarative questionnaires, with no scan of actual data.
APOLLO Data Auditor 6 frameworks scored A–F: GDPR, AI Act, NIS2 and DORA measured from scan; CCPA and SOC 2 via scan + short questionnaire. HIPAA in advisory mode (not graded). Article 30 register auto-generated.

Protection Risk

Evaluated, not assumed
The market Backup solutions without posture audit, or DLP with ransomware alerts but no financial impact simulation.
APOLLO Data Auditor Full infrastructure audit: hardware, RAID, SMART, RPO/RTO. Data Protection Simulation: 5 disaster scenarios costed in € and $ (ransomware, crash, deletion, cloud loss, full disk). Quantified ROSI.

Quality & AI

Is your data ready for AI?
The market Theoretical frameworks from consulting firms, or AI Enterprise modules inaccessible from $100K/year for SMBs.
APOLLO Data Auditor AI Readiness Score on real data: quality, completeness, governance, data lineage, data sprawl. Detects AI blockers before the first sprint, not 18 months and $500K later.
Cost-equivalent stack

Replicating the same BREADTH of surface in best-of-breed

Covering on-premise + cloud + databases + Active Directory + SaaS via multiple best-of-breed tools costs, on real contracts (Vendr medians), ~$266,000 to $767,000/year (median ~$433,000/year).

APOLLO Data Auditor consolidates every connector into one agent, one SMB license < €5,000/year — an order of magnitude of ~50× to ~150× less for the same scan breadth.

Honest disclosure: these platforms deliver continuous protection and remediation. APOLLO Data Auditor = measured audit + €/$ quantification of the same surface breadth, not functional parity. It's a quantified starting point, not a substitute for runtime protection.

14 verified competitors (April 2026). None covers the 4 axes simultaneously under €5,000/yr.

Security & Trust

Is my data secure with APOLLO Data Auditor?

TLS 1.3 end-to-end encryption

All communications between the agent and the cloud Hub are encrypted via TLS 1.3. No data ever travels in clear text, even on your internal network.

Your data never leaves your infrastructure

The agent only sends counters and metadata (e.g. "156 IBANs detected"), never the PII values themselves. Zero data persistence on the cloud side.

Certified multi-tenant isolation

Each client is isolated by a unique API key. Authentication middleware protects 100% of API routes. No cross-client access is possible — audited and validated in production.

100% cloud-side scoring

All scoring algorithms and calculation formulas stay cloud-side. The agent installed on your premises is a pure collector — no business logic is exposed.

Server-side access enforcement

Connectors (Database, Cloud) are blocked server-side based on your subscription — not just in the UI. Your API key is the single source of truth.

Native packaged binary, zero dependencies

The agent is a native packaged binary (PyInstaller). No external dependencies, no runtime to install. Setup in minutes by your internal IT on Windows or Linux.

Zero Exfiltration

Proof, not promises

I published the source code because asking a DPO to trust a black box to audit their data is a contradiction. Verify every claim yourself.

✓ What leaves (counters)
  • • “156 IBANs detected” (counter, not values)
  • • Per file: path, size, SHA256 hash
  • • Per table: row_count, column names
  • • scores = null (scoring 100% cloud-side)
✗ Never leaves
  • • Raw file contents
  • • Database rows
  • • PII values (IBANs, emails, SSNs, cards)
  • • Passwords, API tokens, secrets
Collector, not processor
The agent exports raw metadata. Zero scoring, zero analysis, zero judgment agent-side.
Read-only by architecture
SELECT only. Cloud scopes read-only. Zero write path in the code.
Counters only
No GDPR Art. 30 sub-processor. No DPA. Metadata only.
Verify yourself — don't take our word for it
$ git clone https://github.com/ggabrie2025/apollo_data_auditor
$ python3 -m pytest critical/agent/test_no_pii_content_in_export.py -v
# 5 passed — if any test fails, we're lying.

$ netstat -an | grep apollo-agent
# Only connection: Hub Cloud (443/TLS). Zero third-party analytics.

$ jq '.scores' scan_result.json
# null — scoring is 100% server-side
Download the full White Paper (PDF)
Pricing

Transparent. No commitment.

Free Audit

1 server · 5 scans
0€
 
Get started

Starter

1–3 servers
2 999€/yr
$3,500/yr
Choose Starter

Business

4–10 servers
4 999€/yr
$5,900/yr
Choose Business

Enterprise

11+ servers
Custom
 
Contact us

A server = a single machine (server or workstation) running the agent and scanning its local files, accessible SMB/NFS shares, databases, cloud sources, and LDAP/AD. A server hosting 3 databases counts as 1 server. APOLLO Data Auditor does not perform network scans.

Start your free audit

1 server · 5 scans · 0€ · No commitment

Request my free audit →

Sources & references

Gartner does not endorse any vendor, product or service depicted in its research publications.
Gartner, Forrester, IDC and other brands cited are registered trademarks of their respective owners.

Changelog

What we shipped recently

Features driven by early user feedback.

Agent V1.7-patch31 — May 2026 local agent
“Our Linux servers run Debian — MySQL installs MariaDB there with a root account that doesn’t accept TCP connections.”
MariaDB socket on Debian / Ubuntu — The agent now scans MariaDB instances where network authentication is disabled by default (standard on Debian and Ubuntu). No reconfiguration required.
“We deploy the agent on multiple sites — we can’t tell which scan came from where.”
Multi-site traceability — The server or workstation that ran the scan is now included in Hub reports. Every result is attributed to its source — essential for multi-site audits.
Cloud Hub — May–June 2026 dashboard + scoring
“Our financial regulator will ask for a DORA assessment — we need an evaluation of our operational resilience.”
DORA Operational Resilience — Dedicated DORA questionnaire and scoring (banks, insurers, payment service providers). Integrated into the Executive tab alongside GDPR, NIS2, and AI Act — one unified multi-framework dashboard.
“Our teams use internal AI tools — the AI Act applies to us, but what does it actually require?”
AI Act calibrated by risk tier — AI Act recommendations are now proportionate to the classification of your AI uses (minimal, limited, high risk). Actions target your actual profile, not a generic checklist.
“Where exactly do the cost figures in the report come from?”
Sourced and verifiable benchmarks — Every financial estimate is attributed to its source study: IBM Cost of a Data Breach, ITRC, Sophos, Hiscox, Datto, ITIC. Assumptions are visible and auditable in your reports.
“We want to feed results into our SIEM or internal GRC tool.”
Unified JSON export — The full dashboard (6 tabs, client metadata) exports as a single structured JSON file. Ready to integrate into your GRC, SIEM, or internal reporting tools.
“Leadership wants a high-level view — not a raw list of recommendations.”
Risk map — New executive view: the 4 pillars (Privacy, Compliance, Protection, Intelligence) plotted by incident probability vs. estimated financial impact. Designed for leadership teams and board presentations.
Agent — April 2026 local agent
“We want to track how our exposure evolves over time.”
Snapshots — Automatic save after each scan. Compare results and build a compliance audit trail directly in the Hub.
Cloud Hub — April 2026 dashboard + scoring
“The dashboard is slow to load after a multi-source scan.”
Performance 3–5× — Server-side Redis cache + 8 parallel workers.
“We operate in the US — CCPA doesn't cover our state-by-state obligations.”
US Multi-State Privacy — 20 US privacy laws, revenue-based thresholds, cure period per state.
“Our broker needs a cyber insurance readiness assessment before renewal.”
Insurance Readiness V2 — 8 cyber insurance controls scored + declarative questionnaire.
“We want to see what changes concretely if we fix a specific gap.”
Breach & Data Protection Simulators — Exact GDPR/CCPA penalty and financial exposure recalculation per corrective action. Available in dedicated theaters (Breach Theater, Data Protection Theater).
“Risks are shown source by source — we don't see the connections.”
Cross-source correlations — Cascade badge on priority actions. Shadow data detection across ERP & file systems.
Agent V1.7.R — March 2026 local agent
12 connectors — Files, PostgreSQL, MySQL, MariaDB, MongoDB, SQL Server, OneDrive, SharePoint, Active Directory, Pennylane, infrastructure.
44 PII types — IBAN, SSN (FR/US), email, phone, passport, PESEL, BSN, DNI, codice fiscale and 34 more (EU + US).
Python binary agent with Rust I/O module — 1.16M rows/second (SQL Server benchmark). Native binary for Windows + Linux + macOS arm64.
Zero exfiltration — Public source code. Automated canary test on every release.
Full technical changelog on GitHub →