Is the CyberSigma Data Scanner really free?

Yes — it is completely free to download and use, on Windows, macOS and Linux, with no sign-up. It is a community tool from CyberSigma, a CERT-In empanelled and PCI QSA firm.

Does my data get uploaded anywhere?

No. The scanner runs entirely on your machine and serves its dashboard on localhost only. There is no telemetry and no upload — the only network connections are the database or SSH targets you configure yourself.

Local files and folders (including mounted network shares), databases (PostgreSQL, MySQL, SQL Server, MongoDB) over your LAN, and remote servers over SSH/SFTP. It finds cardholder data (PAN, track, CVV) and PII including Aadhaar, PAN, email, phone and passport numbers.

Is it a replacement for a PCI cardholder-data discovery?

No — it is pattern and checksum based (Luhn, Verhoeff) and complements, not replaces, a full discovery exercise. It is an excellent first pass to find obvious exposure before an audit.

Is the CyberSigma Data Scanner really free?

Yes — it is completely free to download and use, on Windows, macOS and Linux, with no sign-up. It is a community tool from CyberSigma, a CERT-In empanelled and PCI QSA firm.

Does my data get uploaded anywhere?

No. The scanner runs entirely on your machine and serves its dashboard on localhost only. There is no telemetry and no upload — the only network connections are the database or SSH targets you configure yourself.

Local files and folders (including mounted network shares), databases (PostgreSQL, MySQL, SQL Server, MongoDB) over your LAN, and remote servers over SSH/SFTP. It finds cardholder data (PAN, track, CVV) and PII including Aadhaar, PAN, email, phone and passport numbers.

Is it a replacement for a PCI cardholder-data discovery?

No — it is pattern and checksum based (Luhn, Verhoeff) and complements, not replaces, a full discovery exercise. It is an excellent first pass to find obvious exposure before an audit.

Free desktop app · No sign-up

Scan your whole environment for card data & PII

A free desktop scanner from CyberSigma. Point it at your files, your databases, or any server on your LAN and find unencrypted card numbers, track data, CVVs and PII — Aadhaar, PAN, email, phone, passport. Cross-platform, single file, no installer.

🔒 Runs entirely on your machine. No telemetry, no uploads — your data never leaves your network. We built it so it couldn’t.

Download

Pick your platform. The app opens a private dashboard in your browser at 127.0.0.1 — local only.

⊞

Windows

64-bit · Windows 10/11

⤓ Download

Double-click. If SmartScreen warns (the app is unsigned), click “More info” → “Run anyway”.



macOS (Apple Silicon)

M1/M2/M3/M4

⤓ Download

In Terminal: chmod +x the file, then run it. First launch: right-click → Open, or run xattr -d com.apple.quarantine <file>



macOS (Intel)

Intel Macs

⤓ Download

In Terminal: chmod +x the file, then run it. First launch: right-click → Open, or run xattr -d com.apple.quarantine <file>

🐧

Linux

64-bit

⤓ Download

chmod +x sigma-scanner-linux-x64 && ./sigma-scanner-linux-x64

Verify your download against the SHA-256 checksums. The apps are unsigned, so your OS may warn on first launch — the instructions above show how to proceed.

Three ways to scan

📁 File system

Scan any folder on the machine — or a mounted network share / UNC path. Skips binaries, caps large files, walks the whole tree.

🗄 Databases

Connect to PostgreSQL, MySQL / MariaDB, SQL Server or MongoDB over your LAN with a read-only account. Samples rows from every table and scans every value.

🌐 Remote servers (SSH)

Point it at any server you can SSH into. It streams files over the encrypted SSH/SFTP channel and scans them locally — nothing is written to the remote host.

What it finds

💳 Cardholder data

Card numbers (Luhn-validated, all major brands incl. RuPay & Maestro), magnetic-stripe track data, and CVV context — the data PCI DSS Req 3 says must never sit in the clear.

🪪 PII

Aadhaar (Verhoeff-validated), Indian PAN (tax ID), email, mobile number and passport numbers — so you can meet DPDP and data-minimisation obligations.

🎭 Masked by design

Every finding is shown masked (first-6/last-4 for cards, tail-only for IDs). Export a masked CSV report. The tool never displays or stores full sensitive values.

Found data where it shouldn’t be?

That’s usually a scoping problem, not a one-off. CyberSigma is a PCI QSA and CERT-In empanelled — we help you shrink scope, remediate, and prove it. Optional: leave your email for a free findings review. (Your scan results are never sent to us — only your email.)

Prefer no download? The in-browser scanner checks pasted text and files instantly. See all our free tools.

Detection is pattern + checksum based (Luhn, Verhoeff) and complements — does not replace — a full cardholder-data discovery exercise. Use only on systems you are authorised to scan. Provided free, as-is, without warranty.