Privado is an open-source static code analysis tool to discover data flows in the code. It detects more than 110 personal data elements being processed and further maps the data flow from the point of collection to "sinks" such as external third parties, databases, logs, and internal APIs.
We support Java and Python in GA. Our Enterprise offering covers all programming languages, and we're working on adding support for more languages to OSS. Support for JS/TS is coming soon!
First, make sure you have Docker installed on your system, then follow these simple steps to get started with Privado.
curl -o- https://raw.githubusercontent.com/Privado-Inc/privado-cli/main/install.sh | bash
We recommend using this sample app to get started with Privado.
git clone git@github.com:saurabh-sudo/BankingSystem-Backend.git
privado scan <source directory>
The results are generated at <source directory>/.privado/privado.json and a preview will be shown in your terminal.
To visualize the results and generate reports, you can create a free account at the end of a successful scan. Once a scan is complete, it will ask your permission to synchronize the generated results with Privado Cloud Dashboard. Note that no code is sent to the cloud–only the JSON output generated by the scan. Upon successful sync, you can view the results on our free platform.
- Privacy Engineers
- Data Protection Engineers
- Data Governance Engineers
- Security Engineers
- Mobile App Developers
- Developers
Privado lets Engineers ask contextual questions about the usage of sensitive data at scale.
Examples:
- Generate and maintain Data maps and Record of Processing Activity Reports ( RoPA / Article-30 Reports )
- Automate the generation of the data-flow diagrams
- Identify and remove data leaks
- Improve data storage security by identifying and fixing insecure practices
- Finding and fixing unaccounted third-party sharing of data
- Establish and enforce Data Protection and Governance policies
- Generate Android Data Safety Report
- Incorporate various GDPR, CCPA, SOC, ISO, HIPAA, and PCI controls
- Do continuous monitoring for privacy and data issues
- Implement Privacy by Design
Privado can be run locally on your computer or in your CI/CD pipeline. Privado creates a knowledge graph during the scanning process that contextually answers thousands of questions about sensitive data. Since the scan is local, you never have to worry about your code leaving your machine. An output file is stored in JSON format, and the results can be viewed on Privado Cloud.
Privado will discover the following information in the code during scanning and present it in a dashboard for your review.
- Data Elements
- Data Flow Diagrams
- Data Inventory
- Code Analysis
- Issues
Apart from getting a comprehensive outlook of your data practices for Privacy Audits, you can also use the tool to generate various privacy reports to comply with privacy laws like GDPR and CCPA.
Our free cloud platform can be used to generate RoPA reports for one or more synced repositories.
A Data Safety Report is a privacy form needed to publish any Android app on the Play Store. Most of the time, filling out a report means developers asking around the team to find what data they're collecting, spending hours reading SDK docs to see where information gets shared and navigating the complex Playstore form. With our scan, we pre-fill data types that are collected and shared, and our wizard guides you through generating the report.
Please check out our contribution page if you love this project and would like to contribute.