Poirot DSPM

Poirot DSPM is a free, open-source tool for finding sensitive information across databases, cloud storage, and message queues. It suits teams able to run security software themselves and looking for local, AI-assisted classification. Its scanning and validation toolkit is substantial for a free product, though its source coverage will determine whether it fits your environment.

Overview

Poirot focuses on discovering API keys, secrets, PII, and other sensitive data. Self-hosting gives teams control over deployment, while also making operation their responsibility. Its MIT license and free-forever plan remove subscription costs; the tradeoff is that teams need to be comfortable managing the deployment and working within its listed connectors.

Key features

Scanning and detection

Scheduled scans support recurring discovery, and on-demand scans let teams investigate when needed. More than 38 patterns cover API keys, database credentials, authentication tokens, private keys, PII, and custom regular expressions. That range is useful for finding familiar secrets as well as organization-specific data, although the patterns only help where the relevant systems can be scanned.

Six validators check matches using Luhn, SSN, IBAN, entropy, Base58, and database-password checks. Poirot also assigns findings a confidence score from 0.0 to 1.0, drawing on validation, context, and pattern specificity. This offers a way to prioritize review; teams still need to assess what a finding means in its environment.

Classification and operations

AI-assisted classification uses local Ollama, and Poirot says data stays within the user's infrastructure. This is a useful fit for teams that want AI classification without sending data outside their environment, provided they can run the self-hosted setup.

Supported sources include MySQL, PostgreSQL, Oracle, AWS S3, Kafka, Google Drive, and OneDrive. More are marked as coming soon, so connector coverage is a key selection check. Integrations include TheHive, Keycloak, Ollama, PagerDuty, Slack, Microsoft Teams, SMTP email, and webhooks. Docker Compose, Kubernetes, and Helm are listed deployment options.

Keycloak support includes SSO and role-based access control, with realm support, group mapping, and secure token validation. That gives teams a path to connect access controls to an existing identity setup. Poirot is open source under the MIT License; it provides an issue-reporting link and lists [email protected] for contact.

Pricing

Poirot DSPM — free

The free plan is open source, self-hosted, and free forever. It includes sensitive data discovery, AI-assisted classification, cloud and SaaS coverage, and exposure analysis. With no subscription charge, it can suit teams that can host and operate the tool themselves. Its value depends on whether its supported sources cover the systems you need to scan.

Platforms

Poirot is self-hosted, with deployment options for Docker Compose, Kubernetes, and Helm. That flexibility accommodates different deployment approaches, while leaving hosting and operation to the adopting team.

Who it's for

Poirot is a strong candidate for security teams that want free, open-source sensitive-data discovery, need scheduled or on-demand scans, and can use its listed connectors. Local Ollama classification and Keycloak support may also suit organizations prioritizing in-infrastructure processing and established access controls. Teams that need a source not on the connector list, or prefer software that does not require self-hosting, should look elsewhere.

Pros and cons

• Pro: The free-forever, MIT-licensed plan removes subscription costs and leaves the software open source.
• Pro: More than 38 patterns, six validators, and confidence scoring give teams several ways to find and prioritize sensitive-data matches.
• Pro: Local Ollama classification is designed to keep data within the user's infrastructure.
• Con: The tool is self-hosted, so it suits teams prepared to run their own deployment.
• Con: Its listed sources are limited to a defined set, with additional connectors still coming soon; a missing source can make the scanning toolkit irrelevant to a team's environment.

Alternatives

Bedrock Data Security Platform has a free Snowflake plan with weekly scans. Choose it if Snowflake-only discovery is enough; that plan excludes entitlement analysis, custom data domains, findings and policies, access activity, RBAC, and API access.

Onam Security API Security offers a free plan for one cloud account and up to 500 resources, with 30-day finding history and community support, as well as a paid Pro plan at $22 a month. It is a better fit if those cloud-account and resource limits match your needs.

Forcepoint Data Security Cloud is a paid option with a broader listed platform range, including desktop and mobile systems; pricing is by request. Skyhigh Private Access is another paid option, with Android, iOS, macOS, web, and Windows platforms.

Cyberhaven Data Security Platform is a paid option with API, browser extension, Linux, macOS, and web platforms; pricing is provided by request and the company offers a product demo. Palo Alto Networks Cortex Cloud API Security is a paid alternative with API, Linux, and web platforms.

Varonis Data Discovery and Classification is a paid option with Linux, self-hosted, and web platforms, priced by quote. Prisma Cloud SCA is a paid API and web option with a free trial.

For more options, see Data Security Posture Management Software.

Verdict

Choose Poirot DSPM if you want free, open-source sensitive-data discovery with local AI classification and your team can self-host it across the sources you need. Its detection patterns, validators, and confidence scoring make a compelling toolkit without a subscription. Look elsewhere if its connector coverage does not match your environment or self-hosting is not a fit.