PII Scanner Step-by-Step Guide

Step 1 of 12

Welcome to the PII Scanner

This guide shows you how to scan websites for exposed personal data step by step.

A PII scan is an automated check for personal data that a website shows to the public. Personal data is defined as any information relating to an identified or identifiable natural person, in Article 4(1) of Regulation (EU) 2016/679 — the GDPR, in force across the EU since 25 May 2018. Article 5(1)(c) asks for data minimisation. Article 83(5) sets the upper fine band at €20 million or 4% of worldwide annual turnover, and Article 83(4) the lower band at €10 million or 2%. Article 33(1) allows 72 hours to notify a personal data breach. Where an AI system is in scope, the EU AI Act — Regulation (EU) 2024/1689 — reaches €35 million or 7% under Article 99(3). Before you start, four limits are worth knowing: a scan covers at most 1,000 pages, each call to the detection API takes at most 50,000 characters, 20 new scans per hour are available from one IP address, and a finished session leaves server memory 35 minutes after the scan ends.

What You'll Learn

The PII Scanner helps you find personal information exposed on websites, including:

Email addresses and phone numbers
Physical addresses and locations
Government IDs (SSN, IBAN, Tax IDs)
Credit card numbers and financial data
Names and other identifying information

Before You Start

You'll need an API key from anonym.legal, the detection engine behind piisafe.eu.

API plans start at €3/month at anonym.legal.

Step 2 of 12

Open the Scanner

Click "Scan Your Website" to open the scanner tool.

The Scanner Interface

The scanner uses a simple 4-step wizard:

Step 1 - Authenticate: Connect your API key
Step 2 - Configure: Choose what to detect
Step 3 - Target: Enter the website URL
Step 4 - Analyze: Review results and export

Step 3 of 12

Enter Your API Key

Paste your API key to connect to the detection service.

Get Your API Key

If you don't have an API key yet:

Visit your provider's dashboard
Sign up for a free account
Generate an API key in your settings
Copy and paste it into the scanner

Your API key is stored locally and never shared with third parties.

Step 4 of 12

Connected Successfully

Once connected, you'll see your token balance and capabilities.

What You'll See

Token Balance: Your available API tokens
Entity Types: Number of detectable PII types
Languages: Supported detection languages
Presets: Available compliance presets (GDPR, HIPAA, etc.)

Step 5 of 12

Configure Detection

Choose a preset (GDPR, HIPAA) or customize entity selection.

Available Presets

GDPR: European personal data (names, addresses, IDs)
HIPAA: Healthcare data (patient IDs, medical records)
PCI-DSS: Payment card data (credit cards, account numbers)
Custom: Select individual entity types

You can also adjust the confidence threshold for detection sensitivity.

Step 6 of 12

Select Language

Match the language to your target website for best results.

Why Language Matters

Name detection uses language-specific NLP models
Address formats vary by country (postcodes, states)
Phone numbers have different formats per region
National IDs are country-specific (US_SSN, UK_NINO, IN_AADHAAR); IBANs are universal

48 languages are supported. Select the primary language of your target website.

Step 7 of 12

Enter Website URL

Paste the website URL and click "Check" to discover pages.

URL Tips

Enter the full URL including https://
You can scan any public website
For testing, use our demo pages (see below)
The scanner will automatically discover linked pages

Step 8 of 12

Review Discovered Pages

Select which pages to include in your scan.

Page Selection

The scanner crawls the website to find linked pages
Check/uncheck pages to include or exclude them
More pages = more tokens used
Estimated token cost is shown before scanning

Step 9 of 12

Start the Scan

Click "Start Scan" to begin analyzing the selected pages.

What Happens Next

Each page is fetched and analyzed for PII
Deterministic patterns detect structured data (IDs, IBANs)
NLP models detect names and contextual data
Results are compiled in real-time

Step 10 of 12

Watch Progress

Monitor real-time progress as pages are analyzed.

Progress Information

Current page being analyzed
Pages completed vs. total
Findings discovered so far
Tokens used

You can stop the scan at any time if needed.

Step 11 of 12

Review Results

See all detected PII with severity ratings.

Understanding Results

Compliance Grade: A-F rating based on findings
Finding Count: Total PII instances detected
Entity Types: Categories of PII found
Severity: High, Medium, Low risk classification

Click on any finding to see the exact text and location.

Step 12 of 12

Export Your Report

Download your findings as HTML, JSON, or CSV.

Export Formats

HTML Report: Formatted report for sharing with stakeholders
JSON: Machine-readable format for automation
CSV: Spreadsheet-compatible for further analysis

You're Ready!

You now know how to use the PII Scanner. Try it on your own website or use our demo pages below to see it in action.

Open Scanner →

Try It: Demo Pages

Test the scanner on these demo pages with fake PII in different languages. Each page simulates a company website with region-specific personal data. View all demo pages →