Sidian DataGuard

Check the document before it leaves

Sidian DataGuard is a business document-privacy product combining policy-based detection, redaction, controlled sharing and AI Vault stand-ins. Instead of simply blocking a share, it proposes what should be removed, shows the rule behind the finding and lets a reviewer decide. Its strongest fit is a professional team that needs a record of what was sent and why, particularly a law firm handling matters, disclosure and client confidentiality.

The official About page names Ben Reichwein as founder and CEO. The September 28, 2026 privacy policy identifies Sidian Technologies Corp., a company organised in British Columbia, Canada, with a published contact address in Victoria. Logan Chester is listed as CTO, not verified as a co-founder. Founding year and company-wide team size were not verified and remain blank. The service is for businesses and professionals, not personal use or minors.

Policies, exceptions and a human decision

Secure Sends brings documents into a folder, applies selected policy packs and firm-written rules, then shows findings with their context. The supplied official demonstration shows a distribution folder, policy selection, an exception with its impact, review-mode choices and an email/link-sharing dialog. These are genuine product UI views from the vendor’s demo, not a live run on our files.

One source can produce different recipient-specific versions. A reviewer can approve, change or override proposed removals; the record keeps the decision and its governing rule. The sharing flow offers link expiry, notification when opened and a summary of what a recipient sees. Revoking a link stops later access through that link; it cannot be assumed to recall information already read, downloaded or copied. The original file is not the same thing as the transformed recipient copy.

The vendor advertises files read from Microsoft 365, OneDrive, SharePoint and Google Drive, plus an Outlook add-in and Clio. The inspected demo shows local, Microsoft and Google sources; its Clio button is locked, so confirm Clio availability for your deployment before relying on it. The privacy policy describes connected-account tokens and temporary file processing. No connection, consent flow, upload, send or redaction was exercised in this review.

Policy packs for HIPAA, GDPR, CCPA/CPRA, GLBA, ISO 27701 and PIPEDA are advertised, with PIPABC also shown in the product demo. A policy pack is configuration, not a compliance certification or legal conclusion. The terms require a signed business associate agreement before processing HIPAA-covered protected health information. A lawyer still decides privilege and the applicable duty. The website’s accuracy and very-large-production claims were not independently tested.

AI Vault reduces disclosure, but does not anonymise it

AI Vault creates versions with detected names and identifiers replaced by consistent stand-ins so a connected AI tool can work across the material. The privacy policy says every detection and review model is operated by Sidian, rather than sending originals to OpenAI, Anthropic or another third-party AI model provider. An outside AI tool connected through the Vault receives the transformed version under that provider’s own terms.

The limits matter. Detection can miss sensitive text and is less reliable on scanned pages, handwriting, images and complex tables. A missed value passes through unchanged. Presets can intentionally pass amounts, dates and the substance of legal text. Stand-ins are pseudonyms, not anonymisation: surrounding context may still identify a person or matter. Do not treat a synthetic twin as permission to send privileged material to any model.

The marketing says a human resolves results. The September 28 terms and privacy policy qualify that: by default, edits made by a connected AI tool to files in an AI Vault folder apply without a person’s approval. An administrator or folder owner can require approval. Check that setting instead of assuming every change stops for review.

Sidian also promotes Private AI and Sidian Chambers, a separate private-model offering with its own firm-level pricing and performance claims. Those claims are not treated as included DataGuard features or independently verified benchmarks in this listing.

What the monthly price covers

Base is USD39 per named user per month, with 500 documents monthly, up to three policies and a thirty-day audit log. Role controls and priority support are not included. Pro is USD74 per user per month, with 2,500 documents, up to fifteen policies, role controls and an unlimited audit log, but no priority support. Unlimited is USD249 per user per month, with unlimited documents and policies, role controls, an unlimited audit log and priority support. The public comparison table is the basis for these inclusions.

A document is one file regardless of length. Every person with a DataGuard login counts as a seat, including a reviewer who never sends. The full-product thirty-day trial requires no card; no permanent free plan was verified. Annual billing is advertised as paying for ten months and receiving twelve, but an explicit annual invoice amount was not inspected. API pricing is separate and metered per page; its actual rates were not verified. Starting price remains blank in the directory rather than collapsing per-seat limits and tax into one headline.

The terms exclude taxes and provide automatic renewal. Annual or longer plans require non-renewal notice at least thirty days before term end; shorter plans require it before the end. Fees are generally non-refundable except for the terms, an order form or law. Price increases require at least forty-five days’ notice and apply at renewal. A signed order form takes precedence, and there is no service level unless that order includes one.

Read the data-flow policy behind the headline

The homepage says files never leave the environment, nothing is stored and nothing goes to outside services. The current privacy policy gives a more specific account: originals are held temporarily for processing, and Sidian’s services run on US-hosted infrastructure. Railway, Vercel and Modal handle Customer Content; optional AWS Textract receives page images for OCR. Sidian operating its own models does not mean all processing stays inside a customer’s building or cloud account.

Sidian says it does not train or fine-tune on Customer Content and does not permit its service providers to do so. It nevertheless retains detected values, stand-ins, review messages and uploaded policies while an account is active until deletion. Model-service logs can include document content. After account closure there are thirty days to export, followed by deletion within another thirty days, with about four weeks of backup persistence and longer legally needed records. No-copy-of-original-files is not zero data retention.

The vendor describes HTTPS, hosting-provider encryption at rest and additional encryption of the stand-in mapping, connected tokens and Outlook-recorded mail. Some other content relies on provider encryption. A small number of operating engineers can technically access stored Customer Content. This is not a verified end-to-end-encrypted or no-access system. SOC 2 Type II is explicitly in progress, not a completed report; no certification badge or independent security assessment is claimed here.

The website also uses analytics and region-dependent advertising tags. Rejecting marketing does not eliminate cookieless analytics. Customer document processing and website tracking are different data flows and should be assessed separately.

Ashley Richmond’s verdict

I like the idea of making a disclosure decision visible: the content, the rule, the exception and the reviewer belong in the same view. A team that currently checks outgoing documents manually could get a useful starting point and a better decision record.

I would not buy it on the absolute nothing-leaves headline. The policy describes cloud processing, retained detection records and settings that can leave material untouched. I would start with a representative, non-sensitive test set, compare misses and false positives, require review where appropriate, and agree the data-processing terms before connecting real matters. That makes DataGuard a tool to support professional judgment, not a promise that privilege or compliance is automatic.

Review disclosure: October 1, 2026 desk research of the official product, pricing, About, architecture overview, privacy policy, terms and supplied external-sharing demo. Inspected genuine UI video frames for folder policies, exceptions and a share dialog. No account creation, customer documents, source connection, AI Vault tool, redaction test, send, API call, purchase, export, deletion or security audit. Detection accuracy, large-file performance and legal compliance were not independently validated.