Sarghaby Araghatta
Request a free assessment →
Home / Data inventory

Know which of your data your AI can reach, and what we collect about it.

Sargha maps each AI agent and identity to the data stores its permissions allow, and keeps what it collects to a short, plain list.

Which data stores AI can reach

The Sargha data lineage view: counts of data stores, stores reachable by AI, over-privileged access, public exposure and high or critical reach, then a table of stores with the AI agents that reach them, the access level, exposure and owner
Each data store, the AI agents that can reach it, how broad the access is and who owns it. Sample data from the Sargha sandbox.

Who can reach one store, and why

The detail of one data store in Sargha: the AI identity that reaches it, the permission it holds, and the assessment that the access is over-privileged
One store opened: the identity, the permission, and whether the access is justified. Reach is what permissions allow. Sample data from the Sargha sandbox.

See reach per store

For each data store, which AI identities can reach it and over how many paths, and whether the access is over-privileged or public. Store contents are never read.

Secrets stay secret

A provider name, a masked start of the key and its length, never the usable value.

No prompts by default

Prompt, response, clipboard, keystroke, screenshot and file-content collection is off. Optional content inspection is a separate path you control: the browser extension checks submitted text in memory and does not store it.

Policy is explicit

Tenant policy controls what is kept and for how long.

Export is governed

Approved fields only, to destinations you set, with every export audited. A per-tenant allow-list limits where exports can go.

Your model boundary is your choice

Scoring is deterministic and always available. Optional reasoning uses the model and region you approve. Managed tenants run in AWS us-east-1 today. Roadmap Regional data planes are planned.

How it works

Step by step.

  1. Connect read-only cloud accounts

    Sargha reads configuration and permissions, not the contents of your stores.

  2. See reach per store

    Each store shows which AI identities can reach it and how many paths lead there.

  3. Narrow the broad ones

    Start with over-privileged and public access, and record the decision.

Questions

Common questions.

Does Sargha read my data?
No. Reach is based on the permissions you have configured, and store contents are never read.
Where is data kept?
Managed tenants run in AWS us-east-1 today. Customer-cloud deployments keep telemetry in your own account and region.
Where does reasoning run?
Scoring is deterministic and always available. Optional reasoning uses the model and region you approve, and deterministic-only mode sends nothing to a reasoning model.
How long is data kept?
Retention is set per tenant and applied automatically, and deletion on request is available.
Can content be inspected?
Only through a separate, customer-approved policy path. The default is discovery without content, and what is kept is the decision, not the raw content.
What you need
  • Read-only cloud connectors for the accounts you want mapped.
For your technical team

The field-level data dictionary (collected, transformed and excluded), the five processing boundaries and retention controls are in the technical pack, shared with your team under NDA.

Request the demo and technical pack
Get started

See the AI on your fleet in about a week.

Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.

Request a free assessment → Book a 30-minute call