Export Formats

Export your PII scan results in three formats: styled HTML reports for compliance, JSON for integration, or CSV for analysis. Choose the format that fits your workflow.

📄
HTML Report

Professional, printable report with the risk grade, summary cards and full findings tables. Perfect for compliance documentation, audits, and sharing with stakeholders.

  • Styled, branded layout
  • Print-friendly (PDF compatible)
  • Risk grade (A-F) summary card
  • Findings tables by entity type and page
  • Summary statistics
  • Scan timestamp and timing statistics
Best For

Compliance reports, client deliverables, regulatory submissions, board presentations

🔗
JSON

Structured data export with complete metadata. Machine-readable format designed for integration with other tools, dashboards, and automated workflows.

  • Complete metadata included
  • Entity position offsets
  • Severity classifications
  • Scan statistics & timing
  • API usage tracking
  • Integration-ready schema
Best For

API integrations, data warehouses, custom dashboards, automated analysis

📊
CSV

Spreadsheet-compatible export with one finding per row. Easy to import into Excel, Google Sheets, or Looker for filtering, sorting, and analysis.

  • One finding per row
  • Sortable columns
  • Filterable fields
  • Excel/Sheets compatible
  • Entity type grouping
  • Risk severity labeling
Best For

Spreadsheet analysis, team collaboration, data exploration, trend tracking

📋 What's Included in Every Export

All export formats include comprehensive scan data and statistics:

Scan Metadata

Target URL, scan timestamp, duration, and the entity types checked

Risk Grade

A-F compliance score based on PII findings severity and volume

Findings Summary

Total PII instances found, affected pages, entity type breakdown

Entity Types

58 PII types detected: Email, Phone, SSN, IBAN, Credit Card, etc.

Severity Levels

Critical, High, Medium, Low classifications for each finding

Page Breakdown

Findings listed by page URL with exact line numbers and context

Statistics

Token usage, API calls, detection rates, pages per minute, timing metrics

Audit Trail

Configuration, settings used, detection rules applied, compliance preset

Format Comparison

Feature HTML Report JSON CSV
Printable / PDF ✓ Yes ✗ No ✗ No
Visual Formatting ✓ Charts & Design ✗ No ✗ No
Machine-Readable ✗ No ✓ Fully ✓ Yes
Spreadsheet Import ✗ No ✗ No ✓ Direct
Complete Metadata ✓ Yes ✓ Full Detail ✓ Yes
API Integration ✗ No ✓ Ideal ✗ No
Filtering & Sorting ✓ Interactive ✗ Client-side ✓ Native
File Size Larger (styled) Medium Smallest

🔄 Export Workflow

1

Complete Your Scan

Run a full website scan using piisafe.eu. Enter your target URL, configure detection settings, and launch the analysis. Results appear in real-time as the scanner processes pages.

2

Review Results

View your risk grade (A-F), findings summary, and detailed breakdown by page and entity type. Use the interactive filters to focus on critical findings or specific pages.

3

Select Export Format

Click the "Export" button and choose your preferred format:

  • HTML Report for compliance documentation
  • JSON for API integration and automation
  • CSV for spreadsheet analysis

4

Download & Use

Your file downloads automatically. For HTML, open in a browser or print to PDF. For JSON/CSV, import into your favorite tool: Excel, Looker, Python, API endpoint, etc.

5

Archive & Track

Store your exports for compliance records. Compare reports over time to track remediation progress. Use timestamps to document when PII was discovered and fixed.

📎 Sample Export Data

HTML Report (Rendered Preview)

HTML reports are styled, printable documents with summary cards and formatted findings tables.

HTML Report Structure

<!DOCTYPE html>
<html>
<head>
  <title>PII Scan Report — example.com</title>
  <style>/* Branded CSS for printing */</style>
</head>
<body>
  <h1>Website PII Scan Report</h1>
  <div class="meta">
    <p><strong>Target:</strong> https://example.com</p>
    <p><strong>Scanned:</strong> 2026-03-16T14:32:08.000Z</p>
    <p><strong>Duration:</strong> 284 seconds</p>
    <p><strong>Entities checked:</strong> PERSON, EMAIL_ADDRESS, PHONE_NUMBER, IBAN_CODE</p>
  </div>

  <h2>Summary</h2>
  <div class="summary-grid">
    <div class="summary-card danger">
      <div class="value">F</div>
      <div class="label">Risk Grade (A–F)</div>
    </div>
    <div class="summary-card danger">
      <div class="value">124</div>
      <div class="label">PII Instances Found</div>
    </div>
    <div class="summary-card">
      <div class="value">47</div>
      <div class="label">Pages Scanned</div>
    </div>
    <div class="summary-card warning">
      <div class="value">23</div>
      <div class="label">Pages with PII</div>
    </div>
  </div>

  <h2>Findings by Entity Type</h2>
  <table>
    <tr><th>Entity Type</th><th>Count</th></tr>
    <tr><td><span class="entity-tag">EMAIL_ADDRESS</span></td><td>41</td></tr>
    <tr><td><span class="entity-tag">PERSON</span></td><td>33</td></tr>
  </table>

  <h2>Top Pages with PII</h2>
  <h2>Detailed Findings</h2>
  <!-- one table row per finding: entity tag, value, page, confidence score, context -->
</body>
</html>

JSON Export (Structured Data)

JSON exports contain the scan config, every finding (with the image URL and bounding box for image findings) and the summary statistics.

JSON Report

{
  "success": true,
  "report": {
    "sessionId": "ccd398f4-0e5c-423e-beea-a7a8951d8a85",
    "status": "complete",
    "progress": {
      "pagesScanned": 47,
      "pagesTotal": 47,
      "piiFound": 124,
      "pagesWithPii": 23,
      "tokensUsed": 1240,
      "apiCalls": 47,
      "apiErrors": 0
    },
    "config": {
      "targetUrl": "https://example.com",
      "maxPages": 50,
      "includeImages": true,
      "language": null,
      "scoreThreshold": 0.5
    },
    "results": [
      {
        "id": 0,
        "entity_type": "EMAIL_ADDRESS",
        "entity": "EMAIL_ADDRESS",
        "value": "john@example.com",
        "text": "john@example.com",
        "page": "https://example.com/about",
        "context": "Contact our team: john@example.com for support",
        "score": 1,
        "severity": "high",
        "type": "text"
      },
      {
        "id": 1,
        "entity_type": "IBAN_CODE",
        "entity": "IBAN_CODE",
        "value": "[detected in image]",
        "text": "[detected in image]",
        "page": "https://example.com/contact",
        "score": 1,
        "severity": "critical",
        "type": "image",
        "imageUrl": "https://example.com/img/bank-details.png",
        "boundingBox": {
          "left": 124,
          "top": 197,
          "width": 426,
          "height": 30
        }
      }
    ],
    "summary": {
      "grade": "F",
      "criticalFindings": 22,
      "totalFindings": 124,
      "pagesScanned": 47,
      "pagesWithPii": 23,
      "imagesScanned": 12,
      "byEntityType": {
        "EMAIL_ADDRESS": 41,
        "PERSON": 33,
        "PHONE_NUMBER": 28,
        "IBAN_CODE": 22
      },
      "topPages": [
        {
          "url": "https://example.com/team",
          "count": 31
        }
      ],
      "scanDuration": 284,
      "timingStats": {
        "totalDurationFormatted": "4.7m",
        "avgPageTime": 6043,
        "avgApiTime": 260,
        "pagesPerMinute": 9.9
      }
    }
  }
}

CSV Export (Spreadsheet Ready)

CSV exports have one finding per row, ready for import into Excel, Google Sheets, or BI tools.

CSV Format (comma-separated, every field quoted)

# Scan Summary
Target,"https://example.com"
Risk Grade,"F"
Pages Scanned,"47"
Pages With PII,"23"
Images Scanned,"12"
Total Findings,"124"

# Findings
Entity Type,Value,Page,Source,Image URL,Confidence,Severity,Context
"EMAIL_ADDRESS","john@example.com","https://example.com/about","text","","100%","high","Contact our team: john@example.com for support"
"IBAN_CODE","[detected in image]","https://example.com/contact","image","https://example.com/img/bank-details.png","100%","critical",""
"PERSON","Jane Doe","https://example.com/team","text","","85%","high","Team lead: Jane Doe"

Understanding Risk Grades

Every export carries the same risk grade (A–F) the scanner shows on screen. Any finding of critical severity (credit cards, IBANs, national IDs, medical record numbers …) forces an F; otherwise the grade follows the total number of findings. There is no grade E.

A
0–5 findings
no critical severity
B
6–10 findings
no critical severity
C
11–20 findings
no critical severity
D
More than 20 findings
no critical severity
F
Any critical finding
regardless of count

💡 Integration Examples

Excel / Google Sheets

1. Export as CSV

2. Open File → Open and select your CSV file

3. Use native features to filter by severity, page, or entity type

4. Create pivot tables for trend analysis

Python / Pandas

import pandas as pd
df = pd.read_csv('scan_report.csv', skiprows=8)
critical = df[df['Severity'] == 'critical']
print(critical.groupby('Entity Type').size())

JavaScript / Node.js

const data = require('./scan_report.json');
const critical = data.report.results.filter(f => f.severity === 'critical');
console.log(`Found ${critical.length} critical findings`);

Power BI / Looker

1. Import JSON via REST API or CSV via upload

2. Create calculated fields for severity scoring

3. Build dashboards tracking findings over time

4. Set alerts for critical PII discoveries

Custom Webhooks

Parse JSON exports and send notifications to Slack, Teams, or custom endpoints when critical PII is found

✅ Best Practices

  • ✓ Archive Reports: Keep historical copies of all export reports for compliance and audit trails. Use timestamps to track remediation efforts.
  • ✓ Secure Storage: Store exports in secure locations (password-protected, encrypted, or restricted access). PII reports contain sensitive data.
  • ✓ Regular Scans: Schedule periodic scans to track remediation progress. Compare reports over time to verify fixes.
  • ✓ Share Wisely: HTML reports are ideal for sharing with stakeholders and compliance teams. Use PDFs for printed documentation.
  • ✓ Automate Analysis: Use JSON exports with scripts to automatically flag critical findings and trigger remediation workflows.
  • ✓ Track Metrics: Monitor token usage, scan duration, and findings trends across reports to optimize your scanning strategy.

❓ Frequently Asked Questions

Can I export a partial scan?

Yes! You can select specific pages before launching your scan, or filter findings in the results view and export only critical items.

Are exports encrypted?

Exports are generated on demand from your active scan session and downloaded to your device — no copy is kept on piisafe.eu servers. Use your OS encryption (BitLocker, FileVault) to secure export files locally.

Can I print HTML reports?

Absolutely! HTML reports are print-friendly. Open in your browser and use Ctrl+P (Windows) or Cmd+P (Mac). Choose "Save as PDF" for archival.

What's the file size limit?

Most exports are under 5 MB. Very large scans (1000+ findings) may produce larger files, but all formats are optimized for storage and transmission.

Can I share exports with team members?

Yes, all export formats can be shared. For sensitive data, use encrypted messaging or secure file transfer. HTML reports can be shared as attachments or printed for offline sharing.

Are exports GDPR compliant?

An export is not a neutral index. Every finding row carries the detected value itself and roughly 50 characters of surrounding context, so a report about exposed personal data is a document full of personal data. Treat it as such: keep it under the same retention rules as the source data, delete it on the same schedule, and apply the storage-limitation principle of Article 5(1)(e) GDPR to your copy of the report exactly as you apply it to the original.

What an Export Contains, and Why You Need One

An export is a snapshot of a single scan session, written in one of three shapes. The report endpoint accepts format=html, format=json or format=csv and answers HTTP 400 for anything else. Each finding row carries the entity type, the detected value, the page it was found on, the confidence score, a severity level and about 50 characters of context around the match. The HTML report adds the A-to-F risk grade and the summary counts.

Why the file matters

Exports exist because compliance is documented rather than asserted. Article 5(2) of Regulation (EU) 2016/679 — the GDPR, applicable since 25 May 2018 — makes the controller responsible for demonstrating compliance, and Article 30 requires a record of processing activities to back that up. Article 32(1)(d) asks for regular testing and evaluation of technical measures; a dated scan report is one form of that evidence. Article 35 makes a data protection impact assessment mandatory for high-risk processing, and a scan export is a reasonable input to one. Getting this wrong is expensive: Article 83(5) sets the upper fine band at €20 million or 4% of worldwide annual turnover, and Article 83(4) the lower band at €10 million or 2%.

Deadlines an export helps you meet

Deadlines are the other reason to keep the file. Article 33(1) GDPR allows 72 hours to notify a personal data breach; Article 12(3) allows one month to answer an access request under Article 15. Sector rules add their own clocks: NIS2, Directive (EU) 2022/2555, expects an early warning within 24 hours of a significant incident; the US HIPAA Security Rule, under the Act of 1996, expects documentation to be retained for six years; PCI DSS version 4.0, published in 2022 and the only active version since v3.2.1 was retired in March 2024, expects twelve months of audit history. Where an AI system is in scope, the EU AI Act — Regulation (EU) 2024/1689, in force since 2024 — carries penalties of up to €35 million or 7% of worldwide annual turnover. A report you can produce on demand answers all of these faster than a rescan.

Two further clocks show up in the same filing cabinet. The California Consumer Privacy Act of 2018 has been effective since 1 January 2020, with the CPRA amendments operative since 1 January 2023, and it grants access rights that a dated report helps you answer. On the US health side, the HITECH Act of 2009 introduced the HIPAA Breach Notification Rule, four years after the Security Rule took effect in 2005. The AI Act's lower penalty bands — €15 million or 3% under Article 99(4), €7.5 million or 1% under Article 99(5) — attach to record-keeping and information failures rather than to prohibited use, which is exactly the kind of gap an archived export closes. One export can describe up to 1,000 pages and every finding on them, which is usually cheaper to keep than to reproduce.

Export before the session goes

Export while the session is still there. A scan covers at most 1,000 pages, each call to the detection API takes at most 50,000 characters, and 20 new scans per hour are allowed from one IP address — but the binding constraint is simpler than any of those: findings live in server memory only, and the sweep removes a finished session 35 minutes after the scan ends. After that the export in your hands is the only copy that exists.

Ready to export your first scan?

Start scanning websites for PII and export professional reports in minutes. No registration required.

Launch Scanner →

Getting Started

Your first PII scan in 5 minutes. No registration required.

Documentation Index

Browse all piisafe.eu guides, API docs, and resources.

Scanner Guide

Step-by-step tutorial with screenshots and video walkthroughs.

FAQ

Common questions about PII detection, compliance, and APIs.