TigerGate’s Data Security Posture Management (DSPM) product discovers the data stores in your estate, classifies what they hold, and maps who can reach them. Findings land in the same inbox as the rest of the platform. The product’s central distinction is between “we looked and found nothing” and “we could not look”. Every scan reports coverage alongside findings, so a store that was never read is never presented as a clean one.

​
What you get

CapabilityWhat it does
InventoryEnumerates data stores across AWS, GCP and Azure from the control plane — buckets, databases, clusters, warehouses, file shares, backups and snapshots. Reads no data.
ClassificationSamples object and row content against 269 classifiers across PII, PHI, PCI, financial, credentials, HR, legal, intellectual property, AI and telemetry families.
Access mappingBuilds a graph of identities, networks and policies that can reach each store, so a finding says who is affected, not just what is misconfigured.
ExposureCorrelates public reachability with sensitivity — a public bucket holding nothing is not the same finding as a public bucket holding card numbers.
Posture controls104 controls — encryption, backup, logging, retention, residency, exposure and identity — evaluated per store and mapped to GDPR, HIPAA, PCI DSS 4.0, SOC 2, ISO 27001, ISO 27701, NIST 800-53, CCPA and India’s DPDP.
Data flowsTracks where data moves between stores, accounts and regions, including cross-region and cross-account copies.
SaaS sourcesThe same classification applied to Microsoft 365, Google Workspace, Slack, Box, Dropbox, Atlassian, Zendesk, ServiceNow, Salesforce and retained AI provider logs.
Store detailPer store: what data was found and in how many objects, every principal that can reach it with when they last used that access, the retention policy and whether anything enforces it, the encryption key and whether it rotates, and which frameworks that one store breaches.

​
How a scan reaches your data

Scanning is layered, and each layer needs a permission the one before it does not. You can stop at any layer.
TierReadsNeeds
Tier 0 — InventoryControl-plane APIs only. No object bodies, no rows.The read-only posture role. Safe against production from day one.
Tier 1 — Object contentSamples objects inside buckets and containers.A separate verified grant. The posture role is deliberately not sufficient.
Tier 2a — WarehouseSamples rows from BigQuery, Redshift, Snowflake, Databricks.Warehouse credentials or workload identity.
Tier 2b — DatabasesSamples rows from reachable relational and NoSQL databases.A read-only database user, configured per account.
Tier 0 runs as soon as an account is connected. Tier 1 requires an explicit grant and a scan configuration that asks for content — neither alone starts a content read, because content reads open your data and are billed per object on your side.

​
Choosing a deployment shape

Where the scan runs decides what crosses the boundary. All three produce the same findings.
You grant a role; the scan runs on TigerGate’s infrastructure and reads your data over the cloud provider’s API.The fastest to set up and the only shape where TigerGate can start a scan on your behalf. Choose it unless data residency or egress policy rules it out.See Connect a cloud account.

​
Coverage is a first-class result

A DSPM report is only as trustworthy as its denominator. Every scan records:
  • Stores discovered against stores read
  • Services excluded by configuration, reported as not scanned — never as clean
  • Stores that could not be read, with the reason
  • Stores that hit a budget, recorded as read in part
A service you excluded, a permission you did not grant, and a store that came back empty are three different states, and the console keeps them apart.
A store reported as unsupported_format was reached and opened but could not be parsed. A store reported as budget_exhausted was read up to its configured limit. Neither is a clean result — see Scan configuration for how to change what is read.