PII Discovery Scanner¶

The PII Scanner (scanner-pii) is a VirtualSutra agent that discovers personally identifiable information (PII) across inspection targets. It is dispatched by the orchestrator when InspectionScope.pii_scan is set, running in parallel with other scanner tasks.

Availability: not yet tier-gated · Tenant-scoped

See the Tier & Scope Matrix for what "not yet tier-gated" means today.

Image: ghcr.io/virtual-sutra/scanner-pii Redis stream: vsutra:tasks:pii_scanner AgentType: PII_SCANNER cascade_failure: False (a PII scan failure does not block compliance or reporting)

Capabilities¶

PII discovery across configured targets
GDPR / HIPAA / PCI-DSS evidence generation
Findings tagged with source_agent = PII_SCANNER
Single-task per run from PIIScanConfig (SOC2-9)

Configuration¶

Set pii_scan in the inspection scope:

scope:
  pii_scan:
    targets:
      - type: cloud_storage
        alias: my-bucket

Finding Conventions¶

Field	Value
`source_agent`	`pii_scanner`
`resource_type`	`data:asset`
`tags.pii_category`	PII category (e.g. `email`, `ssn`, `credit_card`)