Breach Notification System

After a breach, two questions have statutory deadlines attached: whose information was exposed, and have they been told. Answering them today means a professional-services engagement - commonly one to three dollars per notified person, with project minimums - or an analyst reconciling exports by hand into a spreadsheet that no one wants to defend under examination. Both answers require handing the most sensitive material your organisation will ever hold to somebody else.

Breach Notification System is that workflow as software you run yourself, on your own instance, with nothing sent anywhere.

NOTHING LEAVES THE INSTANCE. This is the design constraint the rest of the product is built around, not a deployment option. Every stage - ingestion, detection, entity resolution, moderation, reporting - executes on the instance, against storage you own. The language model used for name and context recognition is baked into the machine image and loads in offline mode; it is never downloaded at runtime. There is no call to any third-party service, no telemetry, no licence check that phones home, and no path by which breach content reaches a network you do not control. The instance operates correctly in a VPC with no internet gateway and no NAT, and the honest way to confirm that is to launch one with egress denied and watch it work. Your security review should not have to take our word for it.

INGEST. Point it at the material: documents, CSV and JSON exports, database dumps, email, and folders of mixed content. Every artifact is content-hash de-duplicated and logged. Anything unreadable is listed by name with a reason - never silently skipped, because a file dropped without a trace is the one that surfaces in litigation.

DETECT. Structured identifiers are matched by validators, not by pattern alone: Luhn for payment cards, the ABA checksum for routing numbers, mod-97 for IBAN, structural rules for SSN. Names, clinical context and other free-text entities are recognised by the local language model. A custom lexicon layer covers client-specific terms. Every finding carries the engine that produced it, its confidence, its evidence span, and the artifact it came from - so a disputed finding can be traced to the character offset that produced it.

Extended sensitive categories are handled separately and deliberately. Medical conditions that appear in correspondence but never in a personnel file, and content carrying possible reporting obligations, are surfaced for counsel and can never be auto-actioned. The system flags; a person decides.

RESOLVE. Findings become people. Identifiers belonging to one individual are assembled into a single subject carrying the data classes that statutes key on, because notification obligations attach to people, not to rows. Resolution is deliberately conservative by default - a wrong merge means someone never gets notified - and the aggressiveness is a setting you own rather than one we chose for you.

MODERATE. Each resolved person is included or excluded by a reviewer, with a reason recorded. Second-approver sign-off is available per incident. Approval freezes a content-hashed list version; after that, decisions are immutable and any revision opens a new, diffable version. The audit log is append-only and reconstructs who decided what, when, and what it was before.

REPORT. Notification lists, regulator-ready exports including a GDPR Article 33 bundle, and an HTML audit report. Dry-run is the default and the send path refuses to operate against a list that has not been approved and locked.

RULES ARE CONFIGURATION, VERSIONED AND IMMUTABLE. Identifier types in scope, confidence thresholds, custom lexicons, merge behaviour and governing jurisdiction are captured in a named rule set with a content-hash identifier. Editing one mints a new version rather than mutating it, so any job can be re-run under different rules and the two runs compared directly.

THROUGHPUT. Measured at 5.8 records per second, approximately 20,900 records per hour, with entity recognition enabled. Throughput scales with instance size.

DEPLOYMENT. Serves on port 8080 at first boot with no configuration. Restrict that port to trusted ranges - the product keeps your data off the internet, and your security group should keep the interface off it too.