Find out where your data is really going to.
Your applications send business-critical data to cloud providers — CRM, finance, case management. You assume it goes directly to the vendor. Often it doesn’t: intermediaries that aren’t obvious, countries nobody chose, or a destination it was redirected to by someone else.
Is that an acceptable risk? You can’t answer that until you’ve evidenced your own data.
The findings are yours to keep, whether you go further or not.
10
Devices
10
Days
Zero
Changes
This is not a generic demo
Your environment. Real evidence, not demo data.
[ NCSC For Startups logo ]
NCSC For Startups alumni
What the assessment delivers
Which applications are sending data, and to where
Mapped, named, timestamped. Every outbound connection from every monitored application. Your RoPA lists the recipients you know about — this is the list of the ones you don’t.
SENT16:46:40python314\python.exe (sharepoint_mcp.py)18.169.61.189:443Amazon.com, Inc.
All outbound flows are recorded — with the device and user behind each one.
Destinations that don’t match vendor endpoints
Discovers applications and updaters connecting to intermediaries, unknown countries, or destinations they were redirected to.
DESTINATION14:24:00OneDrive\onedrivestandaloneupdater.exe142.250.187.14:443Google LLC
A trusted Microsoft updater, reaching Google. Would you have known?
Destination validation — beyond what DNS tells you
DNS gives you a domain name. DataShield tells you if the IP from DNS actually maps to the application.
processwinword.exe
destination52.109.14.23
asn lookupAS8075 — MICROSOFT CORP
verdictMATCH
Destination IP checked against the ASN that owns it — not against DNS.
Data accountability — evidenced, not reconstructed
Mapped destination data against your regulator’s obligations — ICO, FCA, SRA and others. You get 72 hours to tell the ICO what happened. Forensic reconstruction takes longer than that.
We find 25–45% of application flows aren’t sent directly to the vendor.
Across the estates we’ve measured — and that figure is application flows only, before any malicious activity (which takes the number higher).
The interesting number is yours, not ours.
How it works
Zero configuration. Zero changes. Zero disruption.
Day 1
Setup
Submit a request, then download DataShield directly from the ZORB Portal — code-signed, SHA-256 published, no email attachment. Install on ten Windows 10 or 11 PCs: silent, invisible to users, zero performance impact.
Access is provisioned per request — usually same day.
Days 1–10
Discovery
Every outbound data flow appears in the ZORB Portal in real time. See which applications are sending data and exactly where it is going to.
The assessment runs in discovery mode — nothing is blocked.
Day 10+
Findings
A report of everything we found: applications, destinations, and anything that warrants a closer look. Plus an optional face-to-face review to walk through it. You get evidence, not a presentation.
Findings are yours either way — or discuss moving to protection mode with us.
What we don’t do
We care where your data is going to.Not what it says.
DataShield monitors which applications are sending data and where it is going to. It does not inspect payload content — we have no visibility of your business information, documents, or communications.
That is by design, and it is permanent.
- No system access required
- No DLP changes
- No infrastructure modifications
- No obligation after ten days
Frequently asked questions
Will this disrupt our operations?
No. DataShield installs silently and runs in the background. Zero configuration, zero changes to your existing security stack, zero performance impact. Nothing is blocked.
What happens after I submit?
We email you a link to the ZORB Portal — your business email is the login. You set a password, connect 2FA, and you’re in. From there you download DataShield yourself, with your account’s unique ID already in the install command. It’s code-signed, and we publish the SHA-256 so you can verify what you’ve downloaded. No email attachments, no third-party file links.
What do we need to run it?
Windows 10 or 11. Admin rights to install; after that it runs as a Windows service, so it starts on boot and an ordinary user can’t stop it. No reboot needed — it starts as soon as it’s installed. It runs on Windows Server too, but we’d keep the assessment to PCs. Linux is available on request. There’s no macOS build.
Which ten devices should we pick?
The ten that would be attacked first, or the ten that use the most applications. Finance, the C-suite, anyone handling client or deal data. Ten random machines tell you the estate is fine; ten well-chosen ones tell you something worth knowing.
What if we don’t want to proceed afterwards?
No obligation. The findings are yours to keep — many organisations use them to inform their existing security vendors. If you do want to act on what we found, the same agent moves from discovery to enforcement: application data goes to the vendor it’s meant for, or it doesn’t leave. That’s a separate decision, made once you’ve seen your own evidence.
Can we monitor more than ten devices for more than ten days?
Yes — and the longer it runs, the richer the evidence. Contact us at info@zorbsecurity.com and we’ll extend it to fit.
What do you collect, and what happens to it afterwards?
For every outbound connection: process name, destination IP, timestamp, device and user. We then add the ASN that owns the destination. Device and user are what make an event flow useful — without them you have traffic, not evidence. No payload content. Hosted in the EU. When the assessment ends the data stays yours to download for 30 days, then it’s deleted.
Does this work in a heavily regulated sector?
Yes. DataShield monitors destination and application identity only — no payload content, no business data, no client information. See exactly where your data is going to before a regulator asks you — regulators increasingly treat “we can’t show you” as a finding in its own right, separate from whether anything actually went wrong.
Can I purchase DataShield through my existing supplier?
Possibly — contact us at info@zorbsecurity.com and if your supplier isn’t already a ZORB partner we can work with them directly. Or we can recommend one of our preferred suppliers to match your business.