Sensitive Data Classification

The basics of classification have not changed. You still sort data by sensitivity and protect the top tiers hardest. What changed is where sensitive data lives and who touches it.

A few years ago, most sensitive data sat in databases and file shares. Today a customer's card number might arrive in a Zendesk ticket, get pasted into Slack, end up in a Google Doc and then get dropped into ChatGPT for a summary.

AI agents add another path. Through the Model Context Protocol (MCP), an agent can read Jira issues, Salesforce records, Notion pages or an S3 bucket on a user's behalf. Each of those reads can pull sensitive data into a model without anyone opening a file.

Why classification matters now

You cannot protect data you have not found. Classification tells you where the risky data is, so you spend effort there instead of everywhere.

1. Lower breach impact. Most breaches expose data nobody knew was there: an old export in a shared drive, a password in a Slack thread, a passport scan in a support ticket. Finding and removing it shrinks what an attacker can take.
2. Compliance. GDPR, HIPAA, PCI DSS, CCPA and CPRA all assume you know where regulated data lives. SOC 2 and ISO 27001 auditors ask the same question. AI rules such as the EU AI Act and ISO 42001 now add questions about the data that feeds AI systems.
3. Safe AI adoption. Teams want to use ChatGPT, Claude, Copilot and agents. Classification lets you say yes to those tools while keeping regulated data out of them.
4. Less data to manage. Classification shows you stale and duplicate data. Deleting it cuts storage, audit scope and risk at the same time.
5. Faster incident response. When something leaks, knowing what type of data was involved tells you right away whether you must notify customers or regulators.

✨ Types of sensitive data to find

Most programs start with the same core categories. Secrets now belong on that list too, because AI tools and agents handle them all the time.

Personally identifiable information (PII)

Any data that points to a specific person. Examples include names with addresses, Social Security numbers, passport and driver's license numbers, dates of birth, email addresses and phone numbers. Leaks lead to identity theft, fraud and harassment.

Protected health information (PHI)

Health data tied to a person, such as medical records, lab results, diagnoses, prescriptions, billing codes and insurance member IDs. HIPAA names 18 identifiers that turn health data into PHI, including medical record numbers, health plan numbers, device IDs, IP addresses and full face photos. See the full list in our HIPAA PHI data elements guide.

Payment and financial data

Card numbers, CVVs and expiry dates fall under PCI DSS. Bank account and routing numbers, tax records, payroll files and transaction histories also belong here. Leaks lead to direct fraud and fines.

Secrets and credentials

API keys, cloud access keys, OAuth tokens, passwords, database connection strings, private keys and crypto seed phrases. One leaked key can open far more data than any single file. Developers paste these into chat, tickets, logs and AI prompts every day.

Intellectual property

Source code, product designs, patent drafts, pricing models and trade secrets. These rarely match a fixed pattern, so they need classification based on content and context rather than simple rules.

Business confidential data

Customer lists, contracts, board decks, M&A plans, salary data and unreleased financials. What counts here differs by company, so you need custom definitions.

For every data element Strac detects, see the Strac catalog of sensitive data elements.

A simple four-level framework

Four levels are enough for most companies. More levels sound precise, but people stop applying them correctly.

1. Public. Safe to share with anyone. Press releases, published reports, marketing pages and product docs. The main job here is accuracy, not secrecy.
2. Internal. Meant for employees but low harm if it leaks. Org charts, internal wikis, meeting notes and process docs. Basic access controls are enough.
3. Confidential. Real harm if exposed. Contracts, customer lists, unreleased financials, source code and roadmaps. Limit access to the teams that need it and watch for external sharing.
4. Restricted. Severe legal, financial or personal harm if exposed. PII, PHI, card data, secrets and critical IP. Encrypt it, restrict it to named people, keep it out of chat and AI tools unless redacted, and audit access often.

Two rules keep this working. First, when a file mixes levels, it takes the highest one. Second, the level should follow the data when it is copied, pasted or sent to an AI tool, not stay with the original file.

✨How classification works today

Manual tagging does not scale past a few teams. Modern tools scan content automatically and combine several detection methods, because no single method catches everything.

Patterns and checks

Regular expressions find things with a fixed shape, like card numbers or SSNs. On their own they cause false alarms. Good tools add checks such as the Luhn test for card numbers and look at nearby words like "SSN" or "DOB" before raising a flag.

Machine learning models

Trained models catch what patterns miss: a name next to a diagnosis, an address written in a sentence, or a document that reads like a contract. They also cut false positives by judging the context around a match.

OCR for images and scans

A lot of sensitive data lives in pictures. Think of driver's license photos in support tickets, scanned medical forms, or screenshots pasted into Slack. Optical character recognition (OCR) reads the text inside images and PDFs so it can be classified like any other text.

Files, archives and recordings

Scanning should cover Word, Excel, PDF, PNG, JPEG and ZIP files, not just message text. Call recordings and video meetings matter too, since people read out card numbers and account details on calls.

Custom detectors

Every company has data that no built-in rule knows about, such as internal project codes, customer IDs or contract templates. You should be able to add your own rules, or show the tool examples and let it learn what to look for.

Historical and real-time scanning

A first scan finds what already exists across years of files and messages. After that, real-time scanning checks new data as it is created or shared, so problems are caught in seconds rather than at the next audit.

✨ Classifying data that flows into AI tools and agents

This is the biggest change since the old playbook. Sensitive data now leaves through prompts and agent requests, not just email and file shares.

Prompts and uploads to GenAI tools

Employees paste customer emails into ChatGPT, upload spreadsheets to Claude and ask Copilot to summarize contracts. Classification has to run on the prompt and the upload before they reach the model. The usual fix is to redact the sensitive parts and let the rest through, so people can keep working.

AI agents and MCP

MCP lets an AI agent connect to business apps and read from them directly. An agent in Claude Desktop or Cursor might pull a Salesforce record, a Jira ticket or a file from S3 to answer a question. No person opens the file, so classic file-based controls never see it.

To cover this path, classification has to sit between the agent and the app. Each tool call gets inspected: which tool was called, what data came back, and which person the agent was acting for. Sensitive fields get redacted before they reach the model, and secrets get blocked outright.

Questions to ask about your AI exposure

• Which AI tools and agents are in use, including ones IT never approved?
• Which apps and data stores are those agents connected to?
• Is regulated data, such as PHI or card data, reaching any model today?
• Are API keys or tokens showing up in prompts or agent responses?
• Can you show an auditor a log of what data each agent accessed?

From labels to real risk

A "Restricted" label tells you what the data is. It does not tell you how exposed it is. Data security posture management (DSPM) adds that missing context.

Take two files that both contain customer SSNs. One sits in a locked HR folder that three people can open. The other is in a Google Drive folder shared with "anyone with the link." Same label, very different risk.

To rank risk, look at four things alongside the label:

• Access. Who can open the data, and is it shared outside the company or publicly?
• Location. Is it in an approved system, or in a personal drive, a chat thread or a log file?
• Lineage. Where did it come from, and where has it been copied to since? A card number that started in a support ticket may now sit in three other apps.
• Age. Is anyone still using it? Old restricted data that no one needs is pure risk.

When you combine sensitivity with these factors, you get a short list of real problems to fix first instead of thousands of equal alerts.

Best practices

1. Start with an inventory. List every place data lives: SaaS apps, cloud storage, databases, laptops, browsers and AI tools. Include the apps your AI agents connect to. You cannot classify what you have not listed.
2. Write a short policy. Define your four levels with real examples from your own company. Say what each level may and may not do, including whether it can go into AI tools.
3. Automate detection. Use a tool that scans content, images and files continuously. Manual tagging should be the exception, not the plan.
4. Tie every label to an action. Decide in advance what happens when restricted data shows up in the wrong place: redact it, mask it, apply a label, block the share, delete it or alert the owner. A label with no action is just a report.
5. Cover AI paths from day one. Treat prompts, uploads and agent tool calls as data flows that need the same checks as email.
6. Tune for accuracy. Review false positives in the first weeks and adjust rules. People ignore tools that alert too often.
7. Coach people in the moment. A short note in Slack or the browser that explains why something was redacted teaches more than annual training.
8. Review on a schedule. Re-check classifications and access every quarter, and after any new app, AI tool or reorg.
9. Keep records for audits. Store a log of what was found, where, and what action was taken. Auditors for HIPAA, PCI DSS, SOC 2 and ISO 27001 will ask for it.

What this looks like in practice

Healthcare

A patient emails a photo of their insurance card and a lab report to a clinic's support inbox. The ticket syncs to Zendesk, and a staff member pastes part of it into an AI tool to draft a reply.

• Classification: Restricted. OCR finds the member ID and name on the card image, and the model spots the diagnosis in the lab report.
• Action: Redact the attachment in Zendesk, keep a secure copy for those with access, and strip PHI from the AI prompt before it is sent.

Fintech

An engineer debugging a payment issue pastes a log line into Slack. It contains a full card number and a live API key. Later, a coding agent reads the same log through an MCP connection.

• Classification: Restricted, for both PCI data and secrets.
• Action: Mask the card number in Slack to the last four digits, alert security to rotate the key, and redact both values from the agent's tool response.

Sharing with partners

A sales team shares a customer export in Google Drive with "anyone with the link" so a partner can review it.

• Classification: Confidential, with restricted PII inside.
• Action: Remove public link sharing, notify the file owner, and apply a sensitivity label so the rule follows the file.

✨ How Strac handles classification

Strac finds, classifies and fixes sensitive data in one platform, across SaaS, cloud, endpoints, browsers, GenAI tools and MCP.

• Wide coverage. API connections to Slack, Google Drive, Gmail, Microsoft 365, OneDrive, Zendesk, Intercom, Salesforce, HubSpot, Jira, Notion, Box, AWS S3 and more, with no agents to install for SaaS. Endpoint coverage for Windows, macOS and Linux, plus browser coverage for Chrome and Edge.
• Detection that reads everything. Machine learning and OCR models classify PII, PHI, PCI and secrets in text, attachments, images, PDFs, spreadsheets, ZIP files and audio or video recordings.
• Your own definitions. Add custom rules, or upload sample documents, mark the sensitive parts, and Strac learns to find them going forward.
• GenAI protection. Strac checks prompts and uploads to tools like ChatGPT and Claude, and redacts sensitive data before it reaches the model.
• MCP and agent governance. Strac sits between AI agents and the apps they connect to. It logs each tool call, the data returned and the user behind it, and redacts or blocks sensitive data before the agent sees it. Developers can also use the open source strac-mcp-dlp server to detect and redact sensitive data inside their own agent workflows.
• DSPM context. Historical scans of existing data, continuous monitoring of new data, sharing and access checks, and data lineage that shows where sensitive data has spread.
• Automatic fixes. Redact, mask, label, block, delete, or send alerts to Slack, Teams or your SIEM, based on the policy you set.
• Audit-ready reports. Findings and actions map to HIPAA, PCI DSS, SOC 2, ISO 27001, GDPR and CCPA requirements.

Want to see what sensitive data is sitting in your apps and AI tools right now? Book a demo to see Strac working on your own data.

The bottom line

Classification is no longer a one-time labeling project. Sensitive data now moves through chat apps, AI prompts and AI agents faster than any person can tag it. To keep up, you need tools that scan files, images and recordings automatically, rank findings by real exposure, and fix problems on the spot. That includes data flowing into GenAI tools and through MCP. If your program cannot see what your AI agents are reading, it has a gap.

Spicy FAQs on Sensitve Data Classification

What is sensitive data classification?

It is the process of finding data that could cause harm if exposed, then tagging it by level, such as public, internal, confidential or restricted. The tag decides how the data must be stored, shared and protected.

What is the difference between data classification and DLP?

Classification tells you what the data is. Data loss prevention (DLP) acts on that answer by redacting, blocking or alerting when sensitive data goes somewhere it should not. Classification without DLP is a report. DLP without good classification is noise.

How does DSPM relate to classification?

DSPM uses classification as its starting point, then adds who can access the data, where it lives and how it has spread. That turns a list of sensitive files into a ranked list of real exposures.

Can classification work on images and screenshots?

Yes, if the tool uses OCR. It reads the text inside images, scans and PDFs, so a photo of a passport is caught just like a typed passport number.

How do I stop sensitive data from reaching ChatGPT or other AI tools?

Scan prompts and file uploads before they are sent, and redact the sensitive parts. This lets employees keep using AI tools while regulated data stays out.

What is MCP DLP?

MCP DLP inspects the data that AI agents pull from business apps over the Model Context Protocol. It redacts or blocks sensitive data in each tool call before the agent passes it to a model, and logs what was accessed.

How often should data be reclassified?

New data should be classified as it is created or shared. Review your rules and access settings at least every quarter, and whenever you add a new app or AI tool.