Question 1

What is SailPoint Data Access Security?

Accepted Answer

It is an add-on to SailPoint Identity Security Cloud that governs access to data itself rather than only to the applications that produce it. Concretely, it discovers sensitive information across cloud, on-premises and SaaS environments — personal data, financial records, intellectual property; classifies it automatically and applies consistent tagging and sensitivity labels; integrates third-party classification tags where you already have them; proactively identifies over-privileged access; detects externally shared sensitive content; removes defunct accounts holding sensitive access; highlights regulated and high-risk entitlements; enforces least-privilege policies for every identity including machine identities; and enables fine-grained access reviews of data assets with enough context for reviewers to decide properly. The gap it closes is straightforward once stated. Application-level certification proves that a person should have access to a system. It says nothing about the spreadsheet exported from that system into a shared folder, the file attached to an email, or the team site created for a project that ended three years ago — all of which contain the same sensitive data with entirely separate access. Personal data does not stay inside applications, so an application-level review is an incomplete answer to a data-protection question. TechBag scopes it within the platform decision, in INR with GST.

Question 2

Why does this matter specifically for the DPDP Act?

Accepted Answer

Because of the shape of the question. A regulator examining your DPDP position is not asking which applications process personal data — they are asking where the personal data is, who can reach it, and how you know. Those are questions about data, and application-level identity governance answers questions about applications. Why the distinction has practical consequences: personal data leaves the systems that create it as a matter of routine business. It is exported for a board pack, copied into a working folder during a project, attached to an email chain, uploaded to a team site, shared with a supplier through a link that outlives the engagement. Every one of those copies is real personal data carrying real access, and none of it appears in an application access review because it no longer lives in the application. If your evidence for a DPDP enquiry is a certification report showing that finance-system access was reviewed last quarter, you have answered a different question from the one asked. Experienced auditors notice, and the follow-up question is usually harder than the first. What this product provides instead: discovery of where sensitive data actually sits across cloud, on-premises and SaaS; classification so you know what each piece is; identification of who can reach it, including through over-broad folder permissions and stale external sharing links; and reviews conducted against the data assets themselves. Where it matters most: organisations with substantial unstructured data, which is most enterprises with any history — legacy shared drives, SharePoint and Teams sprawl, cloud object storage nobody has audited. TechBag scopes it against your actual unstructured estate rather than assuming.

Question 3

Does this replace our DLP product?

Accepted Answer

No, and this is the confusion worth clearing up before anyone buys either, because the two are regularly conflated and ending up with the wrong one is expensive. Data Access Security governs data at rest. It finds where sensitive data lives, determines who can reach it, narrows that access, and produces reviews and evidence about the state of access. The question it answers is: who can reach this data. DLP controls data in motion. It watches for sensitive data leaving — uploaded to personal cloud storage, attached to an outbound email, copied to a USB device — and blocks or alerts. The question it answers is: where is this data going. Why they are not substitutes: they fail differently. Perfect DLP will not tell you that a folder of customer records has been readable by your entire company for three years, because nothing is in motion. Perfect data access governance will not stop somebody with entirely legitimate access from emailing a file to their personal address. An organisation running only one has a specific, nameable gap. How they complement each other: access governance narrows who can reach sensitive data, which shrinks the population DLP must monitor and cuts false positives meaningfully. DLP then catches misuse of access that governance has already judged appropriate. Sequencing usually favours governance first for exactly that reason. A useful test on your own estate: if you already run DLP, ask what it tells you about who can access sensitive data sitting still. If the answer is nothing, you have found your gap. TechBag sells both categories and will tell you which one you are actually missing.

Question 4

What makes this harder to implement than application governance?

Accepted Answer

Classification, and we would rather say so now than have you discover it in month four. Why classification is the crux: every downstream capability depends on it. Over-privileged access detection, external sharing alerts, fine-grained certification, least-privilege enforcement — all of them act on whatever classification has decided is sensitive. Get classification wrong and the entire output is wrong in a way that is genuinely difficult to see, because the reports still look authoritative. The two failure modes, both common. Over-classification floods reviewers with false positives — everything appears sensitive, so nothing is treated as sensitive, and within two cycles people are bulk-approving to clear the queue. Under-classification quietly misses the data you bought the product to protect and produces confident coverage reports about an estate you have not actually covered. Neither announces itself. What to do about it: budget classification tuning as a named project phase with real effort attached, not as a configuration step during deployment. Expect iteration — run classification, sample results against what you genuinely know about the data, adjust rules, run again. Critically, involve people who understand the business meaning of the content: a classifier tuned only by IT will systematically misjudge which finance and HR material matters, because that judgement is not technical. What helps materially: SailPoint integrates third-party classification tags, so if you have already invested in labelling through Microsoft Purview or similar, that carries forward rather than being redone. Starting where labels already exist and expanding outward is usually the fastest path. The honest summary: this is a harder product to deploy well than application governance, and anyone presenting it as a switch has not run one.

Question 5

Can we buy it without the SailPoint platform?

Accepted Answer

No. Data Access Security is an add-on to SailPoint Identity Security Cloud, not a standalone product, and we state that early because scoping it as a point solution and meeting the platform price during procurement is a bad conversation to have late. When the arithmetic works well: you already run Identity Security Cloud, or you are buying it for broader governance reasons anyway, and you have substantial sensitive unstructured data. Then this is an incremental decision. The genuine advantage is that identity context flows both ways — the same platform knows who someone is, what applications they can reach, and what data they can reach — and reviewers work in one place rather than two. A separate data-security product cannot match that integration. When it does not work: your entire requirement is data discovery and classification, with no wider identity governance driver. Buying the SailPoint platform for that is a heavy answer, and dedicated data security posture management products — Varonis, Securiti and others, several of which we sell — address it directly and cost less. We would rather point you at one of those than sell a programme that goes mostly unused. The common middle case: you need both, but not simultaneously. Application-level governance typically comes first because that is where audit findings land, and data access governance follows once the foundation exists and the classification investment can be justified against a real requirement. Sequencing it that way is usually cheaper and always less risky than attempting everything at once, and it is what we recommend more often than not.

Question 6

Where is the data this product analyses stored?

Accepted Answer

The analysis runs in SailPoint's platform, which for Indian customers means the AWS Asia Pacific (Mumbai) region, live since 27 November 2024 — SailPoint's ninth point of presence, described as completely isolated from other AWS regions with no data replicated, backed up or stored in any other AWS region. That is a documented statement about storage; SailPoint does not separately document where data is processed, and we are not going to infer it. What matters more here than for other modules: this product handles metadata about your most sensitive information — classifications, locations, access patterns and entitlement details for personal data, financial records and intellectual property. Even where file contents remain in your own systems, the map of where sensitive data lives and who can reach it is itself sensitive, and worth treating that way in your contract. What to establish before signing: the region and the sub-processor list in writing; what data actually leaves your environment versus what is analysed in place, because that varies by connector and deployment; and retention terms for the classification metadata. If you are IRDAI-regulated, remember the 2023 audit annexure asks a direct question about whether ICT logs are held in India. And an internal control worth noting: the platform holding a map of all your sensitive data is a high-value target, so access to the governance system itself should be governed — auditors increasingly ask who governs the governor, and it is a fair question. TechBag helps get all of this documented during evaluation.

Question 7

Why buy this through TechBag?

Accepted Answer

TechBag is a Bengaluru-headquartered reseller serving pan-India, and on this product our value is largely in scoping it correctly and sometimes in telling you not to buy it. Check what you own first: if your estate is Microsoft-centric, you may already hold Purview licensing you have never configured. We would rather you configure what you already pay for than sell you a second product to do the same job, and we ask that question before quoting. Honest product selection: if data discovery and classification is your entire requirement with no wider identity governance driver, we will point you at a dedicated DSPM product — we sell those too — because buying the SailPoint platform to get this add-on is a heavy answer to a narrow question. And if your actual concern is data leaving rather than who can reach it at rest, that is DLP and a different purchase entirely. Project realism: we budget classification tuning as a named phase with effort attached, because that is where these deployments succeed or fail, and we make sure people who understand the business meaning of the data are in the room rather than only IT. If you have existing classification labels, we plan around carrying them forward rather than starting again. Sequencing: we usually recommend application-level governance first and data access governance second, because that is the cheaper and less risky order. Compliance: we get the Mumbai region, sub-processor list and retention terms into the contract, and raise what leaves your environment versus what is analysed in place. And commercially: INR invoicing with GST, and a local point of contact.

Dimension	Application-level review only	Data Access Security (SailPoint)
What gets reviewed	The application	The data asset itself
The exported spreadsheet	Invisible to the review	Discovered and classified
Where sensitive data is	Nobody actually knows	Discovered across cloud, on-prem, SaaS
Over-broad folders	Found after the incident	Proactively identified
External share links	Created and forgotten	Detected and reviewable
Machine access to data	Never reviewed	Governed alongside people
The DPDP question	Answered with an app report	Answered about the data
⚠️ The hard part	(varies)	Classification tuning is a real phase

Dimension	SailPoint DAS	Microsoft Purview	Varonis	Securiti	A DLP product	App-level review only
Position	Data governance inside an IGA platform	Native to Microsoft estates	Data-centric security specialist	DSPM and privacy platform	Data in MOTION — different question	What most organisations have now
Governs data at rest	Yes — the point of it	Yes	Yes — deep	Yes	No — watches data leaving	No
Identity context integrated	Native — same platform as IGA	Via Entra	Own model	Own model	Not its purpose	Yes, but only for apps
Beyond Microsoft estates	Cloud, on-prem AND SaaS	Strongest inside Microsoft	Broad	Broad	Varies	n/a
Buyable standalone	⚠️ No — an add-on to the platform	Yes, in M365 licensing	Yes	Yes	Yes	n/a
Best fit	Already on SailPoint, sensitive data at scale	Microsoft-centric estates already licensed	Data security as the primary discipline	DSPM and privacy as the driver	Stopping data LEAVING	Nothing — the DPDP gap stays open

Data Access Security

The SailPoint platform family

Quick facts

Understand data access governance before you buy it

What is Data Access Security?

Governing the app vs governing the data — the honest table

The five pieces of the platform

Discover Where Sensitive Data Is

Classify And Label Consistently

Find Over-Privileged Access

Review The Data, Not Just The App

Enforce Least Privilege

Twelve capabilities. Discover, classify, review.

Sensitive Data Discovery

Automatic Data Classification

Consistent Tagging & Sensitivity Labels

Proactive Over-Privileged Access Detection

Externally Shared Content Detection

Remove Defunct Accounts With Sensitive Access

Enforce Least-Privilege Policies

Highlight Regulated & High-Risk Entitlements

Fine-Grained Access Reviews Of Data Assets

Human AND Machine Access To Data

Part Of Identity Security Cloud

Data At Rest, Not Data In Motion

Watch the SailPoint platform in action

SailPoint Identity Security Cloud Overview

A guide to SailPoint Identity Security Cloud

SailPoint Non-Employee Risk Management Overview

Certify the application. Or certify the data.

The application review cannot answer a DPDP question

Classification quality decides whether this works

This is not DLP, and the difference matters

An add-on, with the platform arithmetic that implies

The honest scope

The numbers behind the platform

What your Data Access Security evaluation looks like

Ask the DPDP-shaped question of yourself

Check what you already own

Budget classification tuning as a phase

Sequence it after application governance

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag Data Access Grid

Classification Depth × Ease of Tuning

Data Access Security vs the data-governance field

Which approach fits you?

Choose Data Access Security if…

Microsoft Purview if…

Varonis or a dedicated DSPM if…

A DLP product if…

What does ungoverned data access cost you?

Three ways to consume it

Data Access Security

+ Platform add-ons

+ the classification phase

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 8 questions to ask every vendor

Questions buyers ask

Ready to ask the question your reviews cannot answer?