Home

DataShield Wiki

DataShield is a self-hosted service that tells a business whether its employees' data has surfaced in known breaches, with severity-based alerting and a customizable security dashboard.

Status

v1.2.2. The production readiness checklist was completed for v1.0.0: stable migrations, backups with a tested restore, no plaintext secrets, a healthcheck, a logging policy and a strict CSP. See docs/production-readiness.md in the repository.

---

What it does

DataShield connects to your identity provider (Entra ID, Google Workspace, LDAP, AWS, Okta, or inbound SCIM), pulls the employee directory, then checks each employee email against breach-intelligence providers (Have I Been Pwned and others). Matches become breach records and alerts, scored by severity, surfaced on a drag-and-drop dashboard, and pushed out by email, webhooks and SIEM export.

Identity provider  ->  Employee directory  ->  Breach scan  ->  Alerts + Dashboard + Reports
   (sync / SCIM)         (Postgres)            (HIBP, etc.)       (severity, webhooks, email)

Documentation map

Page	What it covers
Getting Started	Prerequisites, install, seed data, first run
Configuration	Every environment variable and what it unlocks
Architecture	High-level design, request flow, directory layout
Database Schema	Prisma models, enums, relations
Breach Scanning	Scan engine, providers, severity, rate limits
Risk Scoring	Company and per-employee risk scores, weights
Directory Integrations	Entra ID, Google, LDAP, AWS, Okta connectors
MFA Coverage	MFA enrollment detection and coverage gaps
SCIM Provisioning	Inbound SCIM 2.0 push provisioning
Dashboard and Widgets	Widget registry, presets, layout persistence
Reports	Report sections, filters, CSV/PDF, scheduled delivery
Exposure Register	GDPR exposure register and 72h workflow
Notifications	Webhook, Slack, Teams, and email channels
SIEM Integration	Alert export and push to SIEM/SOAR
Remediation	Revoke sessions / force resets on the IdP
API Reference	REST endpoints, auth, status codes
Security	Encryption, auth, secret scanning, rate limiting
Authentication	Better Auth, SSO, passkeys, 2FA, invitations
Roles and Permissions	The 36-permission model, roles and escalation controls
Audit Log	What identity and access changes are recorded
Development	CI gates, workflows, contributing, conventions
Troubleshooting	Common errors and fixes

Tech stack

• Next.js 16 (App Router), React 19, TypeScript strict mode
• Prisma 7 with PostgreSQL
• Better Auth (SSO via OIDC, passkeys, TOTP)
• Tailwind CSS, Recharts, react-grid-layout, dnd-kit

Quick links

• Repository: https://github.com/WhiteMuush/DataShield
• Live demo (read only, no signup): https://datashield.melvinpetit.com
• Issues: https://github.com/WhiteMuush/DataShield/issues
• License: source-available (no resale of the software), see the repo LICENSE