Privatrol · privacy and data residency · before you signKnow where the target's data lives, before you sign.
Privatrol finds where a company keeps its data, using public sources only, and checks each place against the privacy and data-residency laws that apply, with the citation and the document to ask for. Then it shows everything else the company exposes: domains, hosts, leaks, people and suppliers, with an A to F grade and the evidence behind every finding.
Free, by invitation · runs on your own server · every query through a VPN exit · public information by default · for organisations with a legitimate interest in the target
Where the data is kept, and which laws apply
A data room rarely says where a target's mail, files and customer systems are stored. Privatrol reads it from the outside, then works out where the organisation operates and checks each location against law data for 91 jurisdictions and 119 laws, each entry with its sources.
Microsoft 365 mailboxes
Read from Microsoft's own routing and checked from two VPN exits in different geographies. A tenant whose answers follow the caller is reported as undetermined, never guessed. Mailboxes in more than one geography are flagged.
SharePoint, OneDrive and Teams
The tenant is proved by its identifier, its farm group and data boundary are read, and Multi-Geo locations are found by name. Teams, which has no public signal, is inferred from the tenant's geography and labelled as inferred.
Mail gateways and senders
Regional mail filtering and sending services are read from the hostnames in the company's mail records, where the provider's own naming states the region.
Cloud hosting regions
The providers' published address ranges map each cloud-hosted system to a region. Content delivery networks are reported as edge networks with the origin not visible, rather than guessed.
SaaS that names a region
Software-as-a-service hostnames that carry a region in their name are read and recorded with how sure Privatrol is: confirmed, strong, indicative, inferred or unknown.
Potential issues, not verdicts
Every finding is a potential issue seen from outside. It names the law, the citation and the document to ask for, such as a transfer assessment, contract clauses or a data-region setting. An outside view cannot see contracts.
The footprint the data room leaves out
A target's own list of its systems is usually its main domain and the ones somebody remembered. Privatrol starts from that domain and follows what public sources say the company actually owns and exposes.
Everything it owns online
Domains, subdomains, sibling and acquired brands, and marketing sites. Only a source whose claim is ownership adds to the footprint: a link or a passing mention is a lead to check, not an asset.
Where it runs
The hosting providers, networks and countries behind each system, alongside the data-location findings above. This is where the mix of clouds, the forgotten legacy server and the third-party services show up.
What is exposed
Internet-facing services and admin panels, certificate and TLS weaknesses, and known vulnerabilities in the software versions those systems reveal.
What has leaked
The company's accounts and data in public breach indexes, so you know which credentials may already be in other hands before you connect networks.
Compliance and privacy signals
Certifications the company claims and can show, its privacy notices and practices, and how its websites handle the basics.
Reputation and stability
Public filings, news and archived pages: the context a security score alone leaves out. The target's key suppliers can be assessed the same way.
One letter, eight parts you can see
Findings roll up into an A to F grade built from eight sub-scores: attack surface, vulnerabilities, credential exposure, web and TLS, reputation, compliance and certifications, data privacy, and business stability.
The weights are fixed and the arithmetic is deterministic, so the same evidence always gives the same grade, and you can see exactly which part pulled the letter down.
- Attack surface58
- Vulnerabilities41
- Credential exposure32
- Web and TLS74
- Reputation90
- Compliance and certifications66
- Data privacy78
- Business stability84
From a list of findings to a view on the deal
A breach-risk profile
Weaknesses are chained into plausible attack paths: how an exposed panel, a leaked password and an old certificate could add up to a compromise, which data would be at risk, and a plain verdict on doing business.
An executive report
A report the deal team can read without a security background, with the technical detail and every source behind it for the people who need to check.
What changed by closing day
Run it again before close and see what is new, fixed or gone, not a fresh report to re-read. Findings you accepted or marked as false positives keep that decision.
Where Privatrol fits in due diligence and integration
Privatrol is at its most useful before you have any access to the target, and again as closing approaches. See every stage of a deal.
Due diligence
- Screen the target from its main domain before anyone has signed a non-disclosure agreement, including where its data is kept and which laws that brings in
- Turn the potential issues into questions and document requests for the target, with the law and citation attached
- Compare the footprint it finds with the systems the data room says the target runs
- Assess the target's key suppliers the same way: the same lens works for a supplier review
- With the target's written permission, confirm exposures with the active check
Integration
- Run it again before closing to see what changed, and whether promised fixes show from outside
- Watch the acquired footprint until it moves under your own
- Re-assess after a rebrand, including the domains you retire
Every finding has to show its evidence
An assessment that invents things is worse than none. Privatrol is built so it cannot quietly do that.
- Each finding cites the public evidence behind it; a finding with no evidence is dropped.
- Any address, domain or account a finding names must appear in the evidence, or it is removed.
- A separate check re-reads each finding's evidence; what it cannot confirm is marked as unconfirmed and does not move the grade.
- A source that was blocked or unreachable is reported as such, never as "nothing found", and a data location it cannot observe is shown as unknown, not guessed.
- Mentioning is not owning: a link to a domain does not make it the target's.
- Every analysis step is logged, so you can see how a conclusion was reached.
It looks at what is already public
Every query goes through a VPN exit. Privatrol reads Microsoft's and the cloud providers' own public routing and address data, certificate transparency logs, DNS, vulnerability catalogues, breach indexes, company filings, archived pages and the target's own public websites. The most it sends the target is an ordinary request for a public web page, the same one any browser makes.
The optional active check
For an assessment where the target has agreed to it, Privatrol can confirm exposures by checking the live web hosts it has already proven belong to the target, and nothing else. It is off unless it is switched on for that assessment.
Use it only with the target's written permission.
Ask for an invitation
Privatrol is free, by invitation, for organisations with a legitimate interest in the company being assessed, such as a buyer in a deal or a customer reviewing a supplier. It runs on your own server and fetches updates when you choose. Before its first assessment it needs a few things in place: a Linux server with Docker, a commercial VPN service, and keys for its sources and an AI provider.
Write with who you are and the company. The invitation comes with the installer and the setup guide.
Privatrol is provided under its licence agreement, which you accept with the invitation.
More about the tool: privatrol.com.
Already using it? Questions, bug reports and ideas are welcome at [email protected].
Email us
Include your name, your organisation and your part in the deal, and the company with its main domain. Please do not send confidential deal documents by email.