BigID

Overview

BigID's centre of gravity is discovery, classification and identity correlation. Everything else it sells is layered on that core, and it holds patents in the area.

Its signature is the identity graph, which answers not just what data you hold but whose it is. Its own framing is finding personal information rather than merely personally identifiable fields.

That correlation is genuinely patented, linking data to specific individuals using machine learning on uniqueness, proximity and frequency, then maintaining a profile per data subject.

One privacy-conscious design detail worth noting: the graph stores pointers to personal attributes rather than the attributes themselves, so building it does not create another copy of the sensitive data.

Classification is broad, with thousands of pre-trained classifiers across more than a hundred languages, going well past pattern matching into language models and named entity recognition.

Coverage is the widest here, spanning structured, unstructured, cloud, SaaS, on-premises, data lakes, developer tools, messaging and even mainframe systems.

Deployment flexibility is its other differentiator and is unmatched in this category: multi-tenant cloud, single-tenant, bring your own cloud, on-premises, hybrid and genuinely air-gapped.

It makes an explicit parity claim there, that this is one platform across every deployment model rather than a downgraded on-premises edition, with configuration, findings and audit logs staying inside your boundary.

Remediation is real rather than advisory, taking native action to delete, mask, redact, revoke, quarantine or move data, with retention and legal hold enforcement.

The published gap against OneTrust is vendor and third-party risk, which it does not sell at all, so a programme needing both will need two tools.

Key features and capabilities

The same headings are used for every privacy & compliance entry, so two tools can be read side by side.

Finding personal data

• Scans structured, unstructured, cloud, SaaS, on-premises, hybrid, lake, file, application and mainframe data
• Classification uses machine learning, language processing, pattern recognition, metadata and policy rules
• Thousands of pre-trained classifiers across more than a hundred languages, extended with language models
• Classifies by sensitivity, policy, type, risk, residency, ownership and business context, including dark data
• A patented identity graph correlates data to specific people, storing pointers rather than the attributes

Consent and subject rights

• Subject request intake from portals, email, phone, post and internal channels, with status tracking
• Identity validation precedes fulfilment, confirming requester, request type and residency
• Identity-aware matching finds the person's data across cloud, SaaS, hybrid and on-premises systems
• Deletion is executed and then validated, to prevent data reappearing afterwards
• Cookie consent is certified by both Google and the advertising bureau, supporting consent mode and privacy control signals

Regulations covered

• Privacy laws including GDPR, CCPA, HIPAA, COPPA, PIPEDA, LGPD, POPIA and several Asian and Gulf regimes
• Security and public sector frameworks including CMMC, FISMA, PCI DSS and the NIST privacy framework
• Financial services frameworks including GLBA, FINRA, BCBS 239 and DORA
• A dedicated EU AI Act page generating reports for system registration and risk assessment
• Out-of-the-box frameworks for the major regimes, with the ability to build your own

Risk assessment and reporting

• Privacy impact assessments as a named module, with posture risk scored on sensitivity, access and context
• AI risk discovery across models, agents, copilots, prompts, vector databases, pipelines and shadow AI
• Shadow AI detection identifies unsanctioned tools and agents operating without governance
• Access risk reporting on over-privileged access, overexposed data and insider risk
• Vendor and third-party risk management is not published, a clear gap against OneTrust

Controls and remediation

• Native remediation to delete, mask, redact, revoke or move data across cloud, SaaS and on-premises
• Published actions also include quarantine, retention enforcement, annotation, archiving and encryption
• Policy-based retention, minimisation and legal hold, with defensible deletion of stale data
• Access governance and activity monitoring enforce least privilege and reduce exposure
• AI policy enforcement spans access, prompts, data usage, model workflows and responses

Integrations

• Coverage across cloud, SaaS, on-premises, hybrid, developer, analytics and AI environments
• Published categories include AI systems, big data, cloud infrastructure, mainframe and unstructured file shares
• Named partnerships with Snowflake, Databricks, Microsoft Purview, Wiz, AWS and HPE
• Ticketing and orchestration through service management integrations
• APIs are treated as first-class and consistent across deployment models, though no public reference page is confirmed

Where it runs and what it costs

• The widest range here, from multi-tenant cloud through bring your own cloud to air-gapped
• An explicit parity claim, that it is one platform across models rather than a downgraded on-premises product
• Configuration, findings, dashboards, APIs and audit logs can stay entirely inside your own environment
• Marketed as sovereign AI, where a boundary may be a country, a business unit or a disconnected network
• Certifications include SOC 2, ISO 27001 and PCI DSS; hosting regions are not published

Pricing

Price on requestQuote only; free trial available

Quote-only, with no prices, currency or amounts published anywhere. The stated basis is a combination of data sources, applications and connectors, deployment type, and the level of services and support, sold as named bundles for security and for privacy rather than as tiers. A free trial is confirmed in BigID's own words, though its length is not published, and no free tier exists. The only published price anywhere on its estate is training, at $3,000 a seat for twelve months.

Vendor pricing page →

Demos and videos

• BigID platform demo Product demo · YouTube
• Data security posture management in five minutes Tutorial · YouTube

About BigID

BigID was founded in 2016 by Dimitri Sirota, its chief executive, and Nimrod Vax, its chief product officer, both alumni of CA Technologies, and is based in New York. It is private and independent, having made no acquisitions and received none. Its own blog publishes funding only to December 2020, when a round led by Salesforce Ventures and Tiger Global took it past a billion-dollar valuation on $144m raised; later figures circulating in trade coverage are not first-party. Investors include Bessemer, Salesforce Ventures, SAP, ServiceNow, Splunk and Tiger Global. It names Telenor and the US Army among customers.

Founded 2016 · New York, New York · bigid.com