Finance & compliance
Self-Serve PII Inventory & Article 30 Data Map
PII inventory and Article 30 records for 5-50 person SaaS, healthtech and edtech teams, priced flat per account and run inside their own cloud.
Founder thesis
Small teams now carry the same GDPR and HIPAA paperwork as big ones, without the staff. Per-gibibyte scanning bills punish exactly those teams. Bet: sell the workflow, a living Article 30 record and a data map, at a flat price, and let the scanner run in the customer's cloud.
What others got wrong
Google's own cost guide warns scan costs can become prohibitively high, yet it still sells inspection at $1.00/GiB for storage and $3.00/GiB for hybrid and content jobs.
Nightfall publishes no self-serve discovery price, so a small team has to book a demo and a proof-of-value before it can buy.
Osano already advertises automated data discovery and Article 30 auto-fill, but hides them behind a demo gate with no published price.
Accountable folds a data inventory and flow map into HIPAA plans from $169/mo without disclosing how much of the inventory work is automated.
What should work
Charge flat per account with unlimited scanned volume, because Google and Macie bill by the byte and Macie's own example hits $151.50/mo at 150 GB automated.
Run the scanner inside the customer's cloud so the vendor never stores raw data, which is what Google and Macie already do on their pricing pages.
Bundle the Article 30 record, data map and masking into one self-serve account, the way Accountable folds a data inventory into already-bought compliance plans.
Publish prices and put free tools at the front instead of a demo gate, the opposite of Osano's route to its paid Data Mapping product.
What kills it
- Presidio is MIT-licensed, so the detector is free and no one pays for detection alone.
- Accountable can add generic PII discovery to its $169/mo plan.
- Osano already lists discovery and Article 30 auto-fill behind its demo gate.
- Google's 1 GiB free tier and Macie's 150 GB free trial blunt the low end.
What users want
4A data processing agreement reviewed without paying thousands of dollars.
A founder on Ask HN wrote, "I'm not making enough money currently to hire a law firm to take care of this".
Compliance guidance not written only for staffed companies, and a way to avoid shutting a project down.
An HN submitter wrote, "The materials out there seem to be designed solely for companies with staff", and a commenter running a static hobby site with analytics said, "if someone does issue a GDPR related request, I'll perhaps respond by taking down the whole project."
A provider that can actually fulfill erasure, subject access and rectification in full.
An Ask HN user asked for one provider that can "actually process these requests in their full extent" and said "none of the big providers (Google, Anthropic, OpenAI, etc) are actually compliant".
Replace a full-time data auditor.
A ZenBusiness testimonial said, "If we didn't have Nightfall, we would need a full-time data auditor. That's headcount that we don't have."
- Sources
- 12
- Checked
- 12
- Competitors
- 6
- Gaps
- 7
- Page checked
- 12 · 100%
- Snippet only
- 0 · 0%
- Documented
- 9 · 69%
- Interpreted
- 4 · 31%
- pricing4
- market4
- complaint3
- playbook1
Competitors
6- Amazon Macie$151.5/mo
- Accountable$9/mo
Parsed from public pricing blurbs (entry paid tier when available). Max in set: $151.5/mo.
| Competitor | From | Free tier | Source |
|---|---|---|---|
| Google Cloud Sensitive Data Protection (Cloud DLP) | Free | Yes | cloud.google.com✓ |
| Amazon Macie | $151.5/mo | Yes | aws.amazon.com✓ |
| Accountable | $9/mo | Yes | accountablehq.com✓ |
| Nightfall AI | Unverified | Yes | nightfall.ai✓ |
| Transcend | Unverified | — | transcend.io✓ |
| Osano | Unverified | — | osano.com✓ |
What customers complain about
7| Gap | Src |
|---|---|
Per-gibibyte expert inspection gets expensive. Google's own guide says costs can become prohibitively high and advises sampling and scanning only changed data. | |
A modest S3 footprint still bills: 15 buckets, 10M objects and 150 GB of automated discovery is $151.50/mo, and one 500 GB targeted job takes it to $651.50/mo. | |
Small operators cannot pay for legal help. An Ask HN founder wrote, "I'm not making enough money currently to hire a law firm to take care of this" and wanted a DPA reviewed "without spending thousands of dollars". | |
Compliance guidance targets staffed companies. An HN submitter wrote, "The materials out there seem to be designed solely for companies with staff", and a commenter said a GDPR request might mean "taking down the whole project". | |
Erasure, access and rectification stay unmet at big vendors. An Ask HN user said "none of the big providers (Google, Anthropic, OpenAI, etc) are actually compliant". | |
A do-it-yourself scanner does not by itself produce an audit-ready record. The Presidio README says it cannot guarantee finding all sensitive information and that "additional systems and protections should be employed". | |
The buyable low end is demo-gated. Nightfall, Transcend and Osano publish no self-serve discovery price, and Osano lists automated discovery and Article 30 auto-fill behind its demo gate. |
Documented Interpreted
How competitors find customers
4| Tactic | Src |
|---|---|
| Open-source the detection engine and launch on Hacker News, then charge for the hosted inventory. Presidio's HN post drew 103 points and 20 comments and the repo sits at 10.9k stars and 1.3k forks, but the submitter was an unrelated user (yarapavan) and nothing ties the post to sign-ups. | news.ycombinator.com✓ |
| Run freemium free tools, self-serve trials and competitor-comparison SEO at the low end, like Accountable's free HIPAA training pages and its 'Accountable vs. Vanta / Secureframe / Sprinto / Compliancy Group / Law Firms / Consultants / DIY' pages, with a 7-day trial and published prices. No conversion metric was found. | accountablehq.com✓ |
| Offer a proof-of-value with a free assessment instead of a self-serve trial. Nightfall's FAQ says the POV connects the customer's real environment and measures detection precision on their own data. No conversion metric was found. | nightfall.ai✓ |
| Ship free public tools as top-of-funnel, like Osano's 'Get a Free Compliance Scan' that checks a URL for GPC recognition and dark patterns. No conversion metric was found. | osano.com✓ |
Your angle & pricing wedge
| Piece | Claim | Src |
|---|---|---|
| Angle | A self-serve workspace that finds PII across the customer's Postgres, S3 and SaaS, generates and maintains an Article 30 record and visual data map, and optionally produces masked copies for staging, priced flat per account with unlimited scanned volume, running inside the customer's cloud so the vendor never stores raw data, plus an MCP/CLI so agents can register a store and re-scan in a pull request. The detector is open source (Presidio, MIT), cloud DLP and Macie have free tiers, Osano already lists automated discovery and Article 30 auto-fill behind a demo gate, and Accountable already bundles a data inventory and flow map into sub-$300/mo plans, so this is packaging and workflow, not new technology. | |
| Wedge | Price flat per account, $49-99/mo with unlimited scanned volume, instead of metering bytes. Google charges $1.00/GiB for storage inspection and $3.00/GiB for hybrid and content inspection (first 1 GiB/month free), Macie charges $1.00/GB inspected on top of $0.10/bucket and $0.01 per 100K objects, the core engine (Presidio) is MIT-licensed, and Macie's own example bills $151.50/mo at 150 GB automated and $651.50/mo with one 500 GB targeted job while Accountable's cheapest plan is $169/mo annual. Google's 1 GiB free tier and Macie's 150 GB free trial blunt the low end, Accountable could add generic PII discovery to its $169/mo plan, Osano already sells discovery and RaPA behind a demo gate, and a $49-99 price on very large estates is unproven. |
How others got traction
3| Move | Why | Src |
|---|---|---|
| Microsoft open-sourced Presidio under the MIT license in 2019, the HN post drew 103 points and 20 comments, and the repo now shows 10.9k stars and 1.3k forks. | A permissively licensed engine plus a front-page launch commoditized the detection layer, though nothing ties the post to sign-ups. | news.ycombinator.com✓ |
| Accountable bundles a data inventory and data flow map into self-serve HIPAA plans ($169-$679/mo billed annually) and compares them against consultants ($10,000-$30,000/yr) and law firms ($25,000-$75,000/yr). | Folding a data inventory into an already-bought compliance subscription is what lets it displace consultant scoping, though churn and how much inventory work is automated are undisclosed. | accountablehq.com✓ |
| Nightfall uses a 7-day proof-of-value and free security assessment instead of self-serve buying, and leads with labor substitution in customer proof. | The durable value being sold is replacing compliance labor, not the detector, so a small entrant has to sell a workflow outcome rather than a scanning API. | nightfall.ai✓ |
Market heat
Accountable's pricing page reports 10,000+ companies and a 30-day average time to compliance, with named plans from $2,028/yr that include Data Inventory and Data Flow Map. Company-reported, not audited.
More ▾PII discovery is a paid hyperscaler line item with published unit prices: Google Sensitive Data Protection (formerly Cloud DLP) and Amazon Macie both sell scanning per GiB/GB.
More ▾Nightfall AI sells per-user DLP and 'AI Governance' and names Snyk, ZenBusiness and Unit21 as customers on its page, all company-published case studies.
Microsoft's Presidio PII engine shows 10.9k stars and 1.3k forks under an MIT license. A project-adoption signal, not proof of paid or DIY demand.
Revenue signals
4| Signal | Src |
|---|---|
Accountable self-reports 10,000+ companies and a 30-day average to compliance, with public prices from $2,028/yr (Basic HIPAA annual) to $8,148/yr (Pro). Company-reported, not audited. | accountablehq.com✓ |
Google Sensitive Data Protection and Amazon Macie publish unit prices but no revenue: Google inspection is $1.00-$3.00/GiB plus $0.03/GB discovery (or $2,500 per discovery subscription unit), and Macie is $0.10/bucket + $0.01/100K objects + $1.00/GB. Rate cards, not revenue. | cloud.google.com✓ |
Presidio publishes no revenue because it is a free MIT-licensed project; its 10.9k stars and 1.3k forks are adoption signals. Nightfall names customers but discloses no ARR, and Transcend and Osano disclose no revenue. | github.com✓ |
Self-serve entry pricing in adjacent compliance products spans about $169/mo (Accountable Basic, annual) into thousands per month for consultants and law firms ($10,000-$30,000/yr and $25,000-$75,000/yr on Accountable's comparison table). Whether buyers will pay for discovery separately is unproven. | accountablehq.com✓ |
Should you build this?
The category pays: Google and AWS sell PII scanning by the byte with published rate cards, Accountable self-reports 10,000+ companies on plans that bundle a data inventory and flow map from $2,028/yr, and Nightfall's enterprise proof is built on replacing a full-time data auditor. The pain is documented: Google's own guide says costs can become prohibitively high, Macie's own examples reach $651.50/mo on a 500 GB targeted job, and small founders on HN say they cannot hire a law firm for a DPA or live with guidance written for staffed companies. Defensibility is the weak part: the detector is MIT-licensed with 10.9k stars, Nightfall, Transcend and Osano publish no self-serve discovery price, and Osano already advertises automated data discovery and Article 30 auto-fill behind a demo gate. So this is workflow and packaging, not technology, and it is not guaranteed to work. Test first: recruit 20 small SaaS, healthtech and edtech teams with live GDPR/DPA or HIPAA obligations, have each show their current Article 30 artifact or admit none exists, their last privacy spend and the amount, and one erasure or access request they could not fulfill, then ask for a $79/mo annual pre-order and kill it if fewer than 6 of 20 show a maintained inventory or prior spend, fewer than 4 pre-pay, or more than half say Osano or Accountable already covers discovery well enough.
More ▾
All sources
12| Source | Kind | Status | Accessed |
|---|---|---|---|
| pricing | page checked | 2026-09-18 | |
| pricing | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| pricing | page checked | 2026-09-18 | |
| pricing | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| playbook | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| complaint | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 | |
| market | page checked | 2026-09-18 |