Discovered and declared, distinguished
The inventory separates fields found by a scan from fields entered by a person, which shows you what the organization did not know it held.
Platform
Six capabilities, in one system of record.
Gravitas discovers the sensitive data in the systems you operate, classifies it, assesses who can reach it, measures your posture against a compliance framework, and keeps the record of every decision. The sections below describe each capability and, where it matters, its limits.
01 — Discovery
Connect a system and see what it contains.
Point Gravitas at a database using a read-only user scoped to the schemas you choose. It introspects the schema, reads a small number of values from each column into memory in order to determine what the column holds, and then discards them.
Read-only by construction
Connections open with read-only mode set server-side and a statement timeout applied. The database itself rejects a write — the guarantee does not depend on our code behaving correctly.
Values are never stored
What is retained is the table name, the column name, the classification, and a shape hint such as email-like or 4-digit numeric. The value itself is never written down.
Credentials encrypted at rest
Stored using AES-256-GCM, never returned by any API response, and removed from error messages before they are displayed or logged.
02 — Classification
Every field receives a category, a sensitivity, and a stated reason.
Fields are assigned to PII, Financial, Credentials, Health, or Behavioral, and rated High, Medium, or Low. Each classification carries a one-line rationale, so that a reviewer can examine the reasoning rather than accept the label.
Context, not pattern matching
A column named ref_id conveys nothing on its own. Classification uses the surrounding system and the shape of real values to reach a judgement.
Bulk or incremental
Classify an entire inventory at once, or configure each scan to classify only what has appeared since the last one.
03 — Access review
Reviews that produce evidence, not only a decision.
Upload an access export and Gravitas assesses each grant against what the systems actually hold. Administrative rights over a database of credentials are treated differently from read-only access to a reference table.
Risk with a stated reason
Each grant is flagged as over-privileged, stale, sensitive-data access, or appropriate, with reasoning that names the system and the data behind the judgement.
A person decides
Nothing is revoked automatically. A named reviewer approves or revokes each finding, and that attestation is recorded against their name and the date.
History is never overwritten
Every review creates a new run. Previous runs and the decisions within them are preserved intact — that history is the audit evidence.
04 — Readiness
An assessment scaled to the size of your organization.
Gravitas assesses your posture against your primary framework — SOC 2, HIPAA, GDPR, or PCI-DSS — using your real inventory and your answers on controls. A thirty-person company and a five-hundred-person company face different expectations for formal process, and the recommendations reflect that difference.
Stated plainly: this is an AI-generated readiness indicator intended to help you prioritise work. It is not a certified audit and it is not a substitute for a qualified assessor. SOC 2 is the framework we support most thoroughly; HIPAA, GDPR, and PCI-DSS assessments are directional guidance.
05 — Data flows
Where the same data appears in more than one system.
Gravitas compares classified fields across systems and surfaces pairs that are likely to hold the same underlying data — the customer email address in your database that also sits in your billing provider and your CRM.
Labelled as inferred, always. These are probable relationships derived from field names, sample shapes, and classification. They are not evidence that data moves between systems; confirming actual movement requires query logs or ETL pipelines. When a reviewer marks a link, that records their opinion that it appears correct — it never converts a suggestion into verified lineage.
06 — Ask
Questions answered from your own records.
Ask where customer PII is stored, who can see sensitive data, or where your largest gap lies. Answers draw only on your inventory, your control posture, and your assessments — grounded in your records rather than general knowledge.