HoundDog.ai

A single scan traces sensitive values as they move through assignments, transformations, and function calls to the places data lands. Its PII detection covers 103 data elements split into PII, PHI, PIFI, and secret categories, and it watches more than 800 sinks such as logs, files, databases, HTTP APIs, cookies, and third-party SDKs. Each flow gets a severity based on the highest sensitivity of the data it exposes, so a leaked credit card number ranks above an email address.

Scans run on a rule-based static analysis engine written in Rust, not on a language model. The same commit produces the same result every time, so you can compare scans across builds without the findings drifting. The engine can scan a million or more lines of code in seconds on a modern laptop. Optional AI review exists on the enterprise tier, but it is off by default and only runs when your organization wires up its own provider.

The second pillar builds a live catalog of every gRPC and Thrift service, its method definitions, and the servers and clients that use them, resolved down to file, line, branch, and commit. It answers a question IDL files leave open: which services consume this API and what breaks if a field or RPC changes. The context is meant for AI coding agents so they stop rediscovering your architecture on every prompt. REST support is on the roadmap.

This static code scanner runs from the command line or from extensions for VS Code, JetBrains IDEs, and Cursor. The CLI takes flags for severity, dataflow traces, and Markdown report output, and separate commands print the current list of supported data elements and sinks. Developers get findings without leaving the editor, and pipeline jobs get the same output for automated checks.

On the enterprise tier, the scanner plugs into GitHub, GitLab, and Bitbucket, and runs on Azure Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, and Jenkins. The self-hosted deployment refreshes the cross-repo catalog in CI on every pull request, so the API context stays current at the speed your team ships. Findings also flow into issue trackers such as Jira and Linear, and into Slack or email alerts.

Organizations can run the platform entirely inside their own network, with the code and the resulting catalog staying within their infrastructure. Self-hosting adds SSO, role-based access control, and audit logs, and connects to the wider platform. For teams that cannot send source to a third party, this is the setup that makes the tool usable at all.

The enterprise tier turns scan results into structured privacy output. It generates RoPA, supports PIA and DPIA work, and maps activity against GDPR, HIPAA, CCPA, and EU AI Act obligations. Each finding carries code-based evidence, so a review points to a specific file and line rather than a note someone typed into a form.