Before you send a file, there's a question worth asking that most people skip: how sensitive is this, actually? Data classification is the practice of answering that question systematically — sorting a document into a sensitivity tier (typically Public, Internal, Confidential, or Restricted) so the handling matches the risk. A price list and a spreadsheet of customer card numbers shouldn't travel the same way, and classification is what tells you which is which before you hit send.
Frameworks like ISO/IEC 27001 (Annex A, information classification) and NIST's guidance on categorizing information sensitivity both build on this same idea: not all data deserves the same protection, so label it first and let the label drive the controls — encrypt this, restrict access to that, delete the other thing on a schedule.
What actually gets checked
Classifying a document by hand means reading it and judging what's inside — slow, and easy to miss something in a long file. A faster starting point is pattern matching: scan the text for the kinds of data that always raise the sensitivity level if present, regardless of context.
FileX's Data Classification Tagger does exactly this, entirely in your browser. It reuses the same detector set as the Anonymize tool — emails, phone numbers, dates of birth, IP addresses, and financial or government-ID identifiers — but instead of redacting what it finds, it counts and categorizes it to suggest a level:
| Level | Triggered by |
|---|---|
| Restricted | A financial account or government-ID pattern: card numbers, IBAN, SSN, PAN, Aadhaar |
| Confidential | Personal contact information: email, phone, date of birth, IP address |
| Internal | Something else the detectors flagged (e.g. a bare URL), but nothing in the two tiers above |
| Public | No built-in pattern matched anything |
The financial and government-ID identifiers aren't matched by shape alone. Card numbers are checked with a Luhn checksum, Aadhaar numbers with a Verhoeff checksum, and IBANs with the mod-97 check the IBAN standard itself defines — the same validation math banks and payment systems use to reject a mistyped number. That cuts down on a plain 16-digit string in a log file getting flagged as a card just because it happens to be the right length.
What it won't catch
This is pattern matching, not comprehension. It can't tell that a paragraph describes an unannounced acquisition, that a spreadsheet of employee names is sensitive even with no email or phone number attached, or that a photo shows something confidential in the background. Nothing that isn't a recognizable, checksummable pattern will trip a detector — and a tool that only looks for pattern matches can't have an opinion about context, tone, or intent.
That's why FileX describes the result as a suggested classification, not a certified one. It's a fast triage pass for a document you're about to send: if it comes back Restricted, you know to stop and think before it goes anywhere. If it comes back Public, that's a reasonable starting signal, not a legal guarantee — you still know your own document better than a regex does, and the tool's report says so explicitly.
From classification to action
A level only matters if it changes what you do next. A practical mapping:
- Restricted — encrypt before sending. FileX's Encrypt tool locks any file behind a password with AES-256-GCM before it leaves your device; think about whether the recipient needs the raw identifiers at all.
- Confidential — same instinct, lighter touch: encryption in transit, and consider whether personal details need to be there before sharing more broadly.
- Internal — fine for internal channels, not for a public link or an open bucket.
- Public — nothing here should surprise you if it leaked, but it's worth having checked rather than assumed.
If a file needs to go out with names, card numbers, or contact details stripped rather than just protected, that's a different job: the Anonymize tool redacts, masks, or pseudonymizes the same categories of data the classifier flags, so you can hand over a version that no longer carries the sensitive fields at all.
Try it before you send
Classification is a five-second check that catches the fifteen-minute-later "wait, did that file have customer data in it?" moment. Drop a document into the Data Classification Tagger — it reads the file locally, never uploads it, and tells you in seconds what it found and what tier it suggests.