Classification

Classification names the data each store holds. The same engine runs in the in-account scanner and in TigerGate’s hosted scans, on your organization’s settings. Everything runs in the scanner’s own process: no model download and no call to an outside service, unless you turn on AI classification.

​

What it detects

The built-in catalogue covers these families: National identifiers are covered by country packs for the Americas, Europe, Asia-Pacific, the Middle East and Africa. Each identifier is checked against its published structure and, where one exists, its check digit.

​

How a value is classified

1. Normalize. Full-width characters, other digit scripts and dash and space variants are folded, so a value is matched however it is written.
2. Match patterns. Each recognizer’s patterns run over the text.
3. Validate. The value must pass its structure and check digit. Repeated and sequential placeholders, and published test values such as test card numbers, are rejected.
4. Weigh context. Field and column names and nearby words raise or lower confidence, so date_of_birth next to a date counts and “order number” next to a digit run counts against it.
5. Score. Each detection gets a confidence tier.

Entity recognition finds person names, postal addresses and organizations in values and free text. A name is kept only when it does not look like code, an organization or a place, and a validated identifier always wins over a name.

​

Classifier engine

Choose the engine in DSPM → Deployments → Settings → Classification → Classifier engine. It applies from each store’s next content scan, hosted and in-account. Only organization owners and admins can change it. Shadow mode lets you compare the two engines on your own data before switching. The comparison holds counts and confidences only, never values. After you switch to the precision pipeline, Findings filed under a class the pipeline no longer produces close on the next full read.

​

Custom data classes

Add classes of your own on the Data page with Add Data Class. The wizard has five steps: Type, Definition, Test, Details and Scope & status. Patterns and dictionaries can also use context keywords (not used, raises confidence, or required within a number of characters), field names, exclusions (values, patterns or nearby terms), and thresholds (minimum matches per object, base confidence). Test the class on sample text or a file before saving. Under Details set the name, category, sensitivity and the other properties the class carries. Under Scope & status choose the accounts and store types it runs on, and how it starts: Every later save creates a new version. A change to your custom classes makes the next run read in full, so existing content is classified with them.

​

Auto-learn and AI suggestions

Both produce candidates for a person to review, never classifications. Review them on the Data page under Learned candidates: Promote turns a candidate into a classifier, Dismiss sets it aside.

• Auto-learn (on by default) proposes a classifier when a field the catalogue does not know holds identifier-shaped values. It sends field names, format masks and a proposed pattern; masked examples only if the deployment shares masked samples and the Data samples policy is Redacted.
• AI classification (off by default) sends fields and files that are still unclassified after a scan to your own AI provider, configured under Integrations → AI Configuration, to name a class from the catalogue. Only field and file names, the store type and format masks (letters as A, digits as 9) are sent, never values. Limit it with Fields per scan (1 to 200) and Requests per scan (1 to 10). Usage appears on AI Usage & Cost.

Turn both on or off in Deployments → Settings → Classification.

​

Data samples

A masked sample is an example of a classified value with most characters hidden. TigerGate never stores a raw value. Choose what happens to masked samples, for the whole organization, in DSPM → Deployments → Settings → Classification → Data samples: Only organization owners and admins with access to every account can change the policy. Each change is recorded in the audit log. While the policy is Omitted:

• The console says that samples are omitted by your organization’s policy wherever samples would appear.
• The deployment’s and the connection’s sample settings are shown disabled. Their stored choice is kept and applies again if the policy returns to Redacted.
• Samples stored before the switch are not shown, but they are not deleted.

Delete stored samples, in the same place, removes the masked samples your organization has stored: those of classifications, data class instances, custom class matches, learned candidates and stored in-account reports. It needs an owner or admin, asks you to confirm, and is recorded in the audit log. Nothing deletes samples automatically. In a large organization the deletion finishes in the background. Under Redacted, later scans store new samples again. Integration events never carry a sample.

​

Known limits

• Bare numbers with no context are not reported. A card number alone in a column named ref, or a nine-digit social security number with no label, stays a candidate. A whole column of check-digit-valid values is promoted.
• Identifiers with no public check digit (for example US SSNs, passports and the UK National Insurance number) are never better than structure plus context.
• Identifiers that share a shape across countries need a country word or field name to tell them apart. Without one, the value is withheld.
• Dates of birth need a birth word or a birth field.
• Organizations named after people can be reported as person names. Names in scripts without capital letters are found only in name fields.
• Formats with no reader, such as SQLite files and images, are reported as not classified, never as clean.