TigerGate Data Security Posture Management (DSPM) finds your datastores, reads their content to classify the data they hold, maps the identities that can reach them, and raises Findings when sensitive data is exposed, unprotected or breaks a policy.

​
What it does

CapabilityWhat you get
DiscoveryEvery datastore in scope: object storage, databases, warehouses, file shares, snapshots and SaaS content.
ClassificationThe data classes each store holds, such as personal, health, payment, financial and credential data, with counts and locations. You can add your own classes.
PostureEncryption, public exposure, logging, backup, retention and residency checks per store.
AccessThe identities that can reach each store, and AI agents and services with reach into sensitive data.
ActivityData access events, data changes, incidents and anomalies from cloud audit logs.
Findings and policiesBuilt-in and custom policies, mapped to frameworks such as GDPR, HIPAA, PCI DSS, SOC 2 and ISO 27001.
Privacy requestsLocate a data subject’s identifiers across the stores that were read, with the regulation’s deadline.

​
Where scanning runs

Data inScanned byWhat you set up
AWS, Azure, Google CloudThe scanner, inside your own account, subscription or projectA Terraform module (or CloudFormation on AWS)
On-prem databases, Kafka and file sharesThe same scanner, on a Linux machine in your networkA Terraform module that renders a systemd service; no instance is created
Microsoft 365, Google Drive, Salesforce, Box, Dropbox, Slack, Jira, Confluence, Zendesk, ServiceNowTigerGate, through each provider’s APIA read-only API credential
Snowflake, Databricks, MongoDB (such as Atlas)TigerGate, through the warehouse’s public endpointA read-only user
For cloud and on-prem data, the content is read where it lives. Only findings and metadata reach TigerGate: masked samples are sent only if you turn on sharing for a deployment, and raw values never leave. See How scanning works.

​
Get started

1

Choose where your data lives

Open Integrations → Overview and choose Data Security (DSPM) for a setup guide per environment (/integrations/overview/dspm), or go straight to DSPM → Deployments → Add deployment.
2

Deploy the scanner or connect a source

For AWS, Azure, Google Cloud or on-prem, follow Before you deploy and the guide for your platform. For SaaS tools and warehouses, follow Connect SaaS sources.
3

Check the first run

The deployment shows registration, preflight checks, the first run’s progress and every store it could not read, each with a fix.
4

Work the results

Start on Datastores to see what each store holds, then Findings for what to fix. See Using the console.
A store that was not read is never shown as clean. Coverage (on Deployments → Coverage) separates stores that were read, stores that could not be read and why, and stores not read yet.