GDPR file integrity monitoring
Know when personal data files change, vanish or stay too long.
You have 72 hours to report a breach from the moment you become aware of it, and a file breach nobody notices can't be handled at all. Alertica checks the folders where your personal data sits from outside your servers, and alerts you when files are changed, deleted or kept past their retention date. Each alert records who reviewed it and why.
- Agentless, nothing to install
- DPA on request
Who it's for
Any business that keeps personal data in files on servers it can reach over SFTP or FTP.
Built for
- EU and UK companies, and anyone processing EU residents' data
- HR exports, customer exports, scanned documents and partner file drops
- IT leads and DPOs who need to show the files are looked after
What Alertica covers in GDPR
Seven obligations Alertica helps you meet for personal data in files, with what stays with you in the last column.
| Article | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| 5(1)(f) Integrity and confidentiality | Process personal data securely, protected against unauthorized processing and accidental loss, destruction or damage. | Alerts when files in the folders you watch are changed, deleted or never arrive. | Encrypt the data, control access to it, and back it up. |
| 32(1)(b) Integrity of systems | Make sure processing systems keep their integrity and availability over time. | Checks the watched files on every scan, contents included, and alerts on change. | Take the other measures your risk assessment calls for. |
| 32(1)(d) Regular testing | Regularly test and evaluate whether your security measures work. | The weekly health email shows that monitoring ran, what it found and what is still open. | Test your other measures. |
| 33(1) and 4(12) Breach notification | Report a breach within 72 hours of becoming aware of it. A breach includes alteration, loss and destruction. | Tells you the scan after files are altered or deleted, so you become aware in time to act. | Assess the breach, and notify the authority. |
| 33(5) Breach record | Document every breach, its effects and the action taken. | The acknowledgement note records what happened and what you did. | Keep the breach register. |
| 5(1)(e) Storage limitation | Keep personal data no longer than necessary. | Alerts when a file stays in a folder longer than the number of days you set. | Set the retention periods, and delete. |
| 32(1)(c) Restore after an incident | Restore availability and access to personal data in good time after an incident. | Alerts when the backup file doesn't arrive or shrinks sharply since the last scan. | Test that restores work. |
What you can show
GDPR has no yearly auditor, but you must be able to show you comply (Article 5(2)), and a supervisory authority asks for evidence after a breach or a complaint. Alertica keeps the record for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note. That note is the start of your breach record, or the reason it wasn't a breach.
-
Twelve months of history
Pro keeps a year of alerts and scans, then deletes them, so Alertica's own records follow storage limitation too.
-
Proof it ran every week
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It is the regular check Article 32(1)(d) asks for, on record.
-
The record in one download
Pick the period and download every alert with who reviewed it, when and the note. A PDF for the authority, or a spreadsheet to filter.
Why from outside the server
-
Nothing to install
No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.
-
File contents stay put
Alertica works out a fingerprint of each file on your server. The contents never leave it. It keeps names, sizes and dates, and we sign a DPA for those.
-
Set up with you
On Pro and Enterprise our team sets up the retention and deletion alerts with you, folder by folder.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Set your rules
Pick a folder and say what matters. We set up the rules for your personal data folders with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept on record.
Questions about GDPR
What Alertica does for personal data in files.
-
Does Alertica make us GDPR compliant?
GDPR asks for measures suited to your risk. Alertica is one of them for personal data in files, with a record that it runs.
-
When do the 72 hours start?
When you become aware of the breach (Article 33(1)). Alertica shortens the time a file breach goes unnoticed: you hear about it the scan after it happens.
-
Can it enforce our retention periods?
It tells you when a file has stayed past the limit you set. Deleting it stays with you or your cleanup job.
-
Do you see the personal data?
Your file contents never leave your server; only a fingerprint of each file does. Alertica does keep file names, so it acts as your processor for those. We sign a DPA with every customer who needs one: ask us and we'll send it.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
Set up your personal data folders with our team
Tell us where personal data sits in your files. We'll set up the change, deletion and retention alerts with you and go through the first scan together.