Introduction

ARMOR Discovery is a cloud‑native, multi‑tenant data discovery and remediation platform designed to scan enterprise data sources, identify sensitive information, assess risk, and enable remediation actions. The architecture follows a control‑plane and data‑plane separation, integrating SaaS and on‑premises data sources with centralized policy enforcement, identity management, analytics, and reporting.

At a high level, the system consists of:

• A browser‑based control plane for configuration, cataloging, and remediation
• Cloud‑hosted discovery and security
• Connectors for SaaS and On‑premises data sources
• Semantic analysis and inference engines for classification and risk assessment
• Reporting, auditing, and telemetry pipelines for compliance and monitoring

Key Architectural Domains

Control Plane (User Interaction Layer)

Data Control Tower (Browser)

The Data Control Tower is the primary user interface for administrators and security teams.

Responsibilities

• Repository configuration
• Data catalog view
• Risk visualization
• Remediation management

Interactions

• Communicates securely with cloud services over HTTPS (443)
• Integrates with the Seclore Policy Server for policy‑driven controls
• Uses SSO capabilities for secure access

Cloud Services Layer (Seclore Multi‑Tenant Cloud)

Identity and Access Management

IAM Service

The IAM Service provides centralized authentication and authorization.

Responsibilities

• User authentication
• Authorization and role enforcement

Integrations

• Uses OIDC / SAML for SSO
• Supports Single Sign-On (SSO) integration with enterprise identity providers (e.g., Azure AD, Google, Ping) or with a Policy Server (PS), allowing authentication through either PS or an external SSO provider.
• Enforces secure access across all services

Discovery Service

Responsibilities

• Repository configuration
• Orchestration of scans
• Data catalog generation
• Risk insight generation

Data Handling

• Metadata‑driven discovery
• No raw content storage in the catalog database
• Stores repository configuration details and securely manages repository connection credentials (secrets) needed to access source systems, ensuring controlled connectivity and supporting a privacy-by-design approach

Interactions

• Orchestrates scans by assigning an agent to scan the data source and securely providing the agent with the required repository connection details
• Receives scan results from connectors
• Sends metadata to the inference engine

Security Service

Responsibilities

• Definition and enforcement of remediation policies
• Execution of remediation actions based on risk and policy
• Coordination with connectors for action execution

SaaS Connector

Responsibilities

• Scanning SaaS data sources
• Metadata extraction
• Triggering remediation actions where applicable

Communication

• Connects to SaaS data sources over HTTPS (443)
• Communicates securely with discovery and security services

Data Sources and Enterprise Environment

SaaS Data Sources

Examples shown in the architecture includes the following:

• SharePoint
• Google Drive
• Box
• Dropbox
• Jira
• Confluence

Access Characteristics

• Secure API‑based access
• Authentication via enterprise SSO
• Scanned through the SaaS Connector

On‑Prem Data Sources

Examples include:

• File servers
• Network shares

Access Characteristics

• Connected using SMB (445) or relevant protocols
• Scanned via the On‑Prem Connector

On‑Prem Connector

Responsibilities

• Scans on‑premises data sources
• Extracts metadata and classification signals
• Executes remediation actions locally

Communication

• Secure outbound communication to cloud services over HTTPS (443)
• Action orchestration via AMQP (5671)

Intelligence and Analysis Layer

Semantic Analysis

Capabilities

• Named Entity Recognition (NER)
• Semantic understanding of data
• Contextual classification

Technology

• Uses self‑hosted LLMs
• Operates on extracted signals rather than storing content

Inference Engine

The inference engine is responsible for transforming scan metadata into meaningful insights.

Functions

• Context enrichment (sensitivity, business relevance, etc.)
• Risk aggregation
• Data inventory creation

Output

• Classified metadata
• Risk scores and categories
• Use Catalog database as an input

Catalog Database

Purpose

• Stores metadata only
• Maintains data inventory and classification results

Key Principle

• No content storage, ensuring minimal data exposure

Data Masking

Data Masking ensures that sensitive information within document content is protected before any data is transmitted to the AI service. A dedicated Data Masking component within the Surface Connector applicable to both on-prem and SaaS deployments detects confidential elements such as personal or business-sensitive data and replaces them with tokenized or dummy values. This ensures that only sanitized content is used for semantic analysis, preserving privacy without compromising the accuracy and relevance of AI-driven insights.

Supported by additional controls like temporary storage, immediate data purging, and region-specific hosting for compliance

Reporting, Auditing, and Telemetry

Reporting, Auditing, and Telemetry Pipeline

Responsibilities

• Centralized audit logs
• Scan and remediation telemetry
• Compliance reporting

Consumers

• Internal dashboards
• External analytics systems
• SIEM integrations

Analytics and Monitoring

Capabilities

• Security analytics
• Operational monitoring
• Integration with SIEM platforms

Communication

• Secure ingestion over HTTPS (443)

Policy and Governance Integration

Seclore Policy Server

Responsibilities

• Policy definition and enforcement
• Data access controls
• Digital Asset Classification (DAC)

Integration Points

• Data Control Tower
• IAM Service
• Remediation workflows

Step‑Wise Workflow

This section describes the end-to-end workflow:

1. Step 1: User Authentication and Access Initialization
   1. The Security Admin accesses the Data Control Tower through a web browser.
   2. User authentication is handled by the IAM Service using SSO via enterprise OIDC/SAML identity providers (for example, Azure AD or Google).
   3. Upon successful authentication, role‑based access and tenant context are enforced.

2. Step 2: Repository Configuration and Scan Setup
   1. The admin configures repositories (SaaS or on‑premises) from the Data Control Tower.
   2. Configuration details are securely transmitted over HTTPS (443) to the Discovery Service in the Seclore multi‑tenant cloud.
   3. The Discovery Service stores repository configuration and scan metadata (not content).

3. Step 3: Scan Orchestration
   1. The Discovery Service initiates scan jobs based on configured repositories and schedules.
   2. Depending on the data source type:
   3. SaaS Connector is used for cloud applications.
   4. On‑Prem Connector is used for internal enterprise data sources.

4. Step 4: Data Source Scanning
   1. The SaaS Connector connects to SaaS data sources over HTTPS (443) using secure APIs.
   2. The On‑Prem Connector scans enterprise data sources using native protocols such as SMB (445).
   3. Connectors extract metadata and classification signals without transferring raw file content.

5. Step 5: Policy and Remediation Setup
   1. Remediation and security policies are defined through the Security Service.
   2. Policies are aligned with governance rules and enforced via the Seclore Policy Server, including DAC controls where applicable.

6. Step 6: Semantic Analysis
   1. Metadata is passed to the Semantic Analysis layer.
   2. The system performs:
      1. Named Entity Recognition (NER)
      2. Semantic classification
      3. Contextual understanding using self‑hosted LLMs

7. Step 7: Data Masking
   1. The extracted content is passed to the Data Masking component embedded within the Surface Connector.
   2. Sensitive data elements (e.g., PII, PCI, identifiers) are:
      • Detected
      • Tokenized
      • Replaced with dummy or masked values
   3. The original sensitive values are never forwarded beyond the connect

8. Step 8: Metadata Transmission to Cloud
   1. Extracted metadata is securely sent to the cloud over HTTPS (443).
   2. Remediation commands, when required, are communicated to connectors using AMQP (5671).

9. Step 9: Inference and Risk Evaluation
   1. The Inference Engine enriches metadata with contextual attributes such as sensitivity and business relevance.
   2. Risk is calculated through:
      1. Risk aggregation
      2. Sensitivity classification
      3. Data inventory correlation
   3. Only enriched metadata and risk indicators are produced no content is retained

10. Step 10: Catalog and Inventory Update
    1. Processed metadata is stored in the Catalog Database.
    2. The database maintains:
       1. Data inventory
       2. Classification results
       3. Risk insights
    3. The catalog explicitly stores metadata only, ensuring minimal data exposure

11. Step 11: Visualization and Risk Review
    1. Updated catalog and risk insights are surfaced in the Data Control Tower.
    2. Admins review:
       1. Sensitive data distribution
       2. Risk posture
       3. Repository‑level insights

12. Step 12: Remediation Execution
    1. Based on defined policies and risk thresholds, the Security Service triggers remediation actions.
    2. Actions are executed by the respective connectors (SaaS or On‑Prem).
    3. Enforcement is governed by policies defined in the Seclore Policy Server.

13. Step 13: Auditing, Reporting, and Telemetry
    1. All scan activities, policy decisions, and remediation actions are captured by the Reporting, Auditing, and Telemetry Pipeline.
    2. Logs and metrics are forwarded securely over HTTPS (443).

14. Step 14: Analytics and Monitoring
    1. Telemetry data is consumed by Analytics and Monitoring systems.
    2. Integration with SIEM platforms enables:
       1. Security monitoring
       2. Compliance reporting
       3. Operational visibility

End-to End Outcome

ARMOR Discovery delivers continuous visibility into enterprise data, identifies sensitive information, assesses risk, and enforces remediation while maintaining strong security, policy control, and zero content retention in the cloud.

End‑to‑End Data Flow Summary

1. End‑to‑End Data Flow Summary
2. Admin configures repositories using the Data Control Tower.
3. IAM authenticates users via enterprise SSO.
4. Discovery Service orchestrates scans using SaaS or On‑Prem Connectors.
5. Connectors scan data sources, extract metadata, and send results securely.
6. Semantic Analysis and Inference Engine classify data and assess risk.
7. Catalog Database stores metadata, enabling search and inventory views.
8. Security Service applies remediation policies and triggers actions.
9. Telemetry pipeline records events for auditing and analytics.
10. SIEM and monitoring tools consume logs for compliance and security operations.

Architectural Characteristics

• Multi‑tenant SaaS architecture
• Zero content retention in central systems
• Policy‑driven remediation
• Secure, encrypted communication
• Extensible connector framework
• Enterprise‑grade identity and access control