> For the complete documentation index, see [llms.txt](https://docs.sudoplatform.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sudoplatform.com/guides/digital-account-protection/analysis-data.md).

# Analysis Data

## Analysis Data

Both Analysis Results and Organization Analysis expose a structured privacy analysis payload through their `data` field. The two features differ in scope and retrieval, but the payload itself is identical. This page documents that shared payload.

The `data` field is populated when the analysis status is `COMPLETE` or `PARTIAL`. For other statuses, `data` will be undefined.

#### Analysis Status

An analysis reports one of the following statuses:

| Status        | Description                                                                                            |
| ------------- | ------------------------------------------------------------------------------------------------------ |
| `PENDING`     | The analysis is queued or an asynchronous source is still resolving. Re-query for the terminal result. |
| `COMPLETE`    | The analysis has completed successfully with full data.                                                |
| `PARTIAL`     | The analysis has completed with partial data available.                                                |
| `FAILED`      | The analysis encountered an error and could not complete.                                              |
| `UNAVAILABLE` | The analysis data is not available.                                                                    |

#### Privacy Score

The privacy score provides an overall numeric assessment (0–100) of the organization's privacy practices. A higher score indicates better privacy practices. The `breakdown` field reports how the privacy score was determined. The `coverage` field reports how much of the scoring-relevant input had a known value; a low ratio means the score rests on few known signals and should be treated as lower-confidence.

{% tabs %}
{% tab title="Typescript" %}

```typescript
const privacyScore = analysisData?.privacyScore
if (privacyScore) {
  const { score, breakdown, coverage } = privacyScore
  console.log(`Overall score: ${score}/100`)
  console.log(`Coverage: ${coverage.evaluated}/${coverage.total} aspects`)
  for (const contribution of breakdown) {
    console.log(`  ${contribution.aspect}: ${contribution.contribution}`)
  }
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
if let privacyScore = analysisData?.privacyScore {
    print("Overall score: \(privacyScore.score)/100")
    print("Coverage: \(privacyScore.coverage.evaluated)/\(privacyScore.coverage.total) aspects")
    for contribution in privacyScore.breakdown {
        print("  \(contribution.aspect): \(contribution.contribution)")
    }
}
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
val privacyScore = analysisData?.privacyScore
if (privacyScore != null) {
    println("Overall score: ${privacyScore.score}/100")
    println("Coverage: ${privacyScore.coverage.evaluated}/${privacyScore.coverage.total} aspects")
    for (contribution in privacyScore.breakdown) {
        println("  ${contribution.aspect}: ${contribution.contribution}")
    }
}
```

{% endtab %}
{% endtabs %}

| Property    | Type                 | Description                                               |
| ----------- | -------------------- | --------------------------------------------------------- |
| `score`     | number               | Numeric score (0–100). Higher is better.                  |
| `breakdown` | ScoreContribution\[] | How each aspect contributed to the score.                 |
| `coverage`  | ScoreCoverage        | How much of the scoring-relevant input had a known value. |

Each `ScoreContribution` has an `aspect` identifier (e.g. `dataCollection`, `dataSharing`) and a numeric `contribution` (negative = penalty, positive = bonus). `ScoreCoverage` reports `evaluated` (aspects with a known value) out of `total` (aspects the calculator considers).

#### Privacy Summary

A concise human-readable summary of privacy findings, including up to 5 key takeaways. An example of this might be:

* Collects 13 categories of personal data including location data, biometric data, background check data and 10 other categories.
* Collects sensitive data (location data) for non-essential purposes.
* Shares location data, other data, personal identifiers and 7 more with third parties.
* Sells personal information (opt-out available).
* Uses location data, other data, personal identifiers and 4 more for advertising.

{% tabs %}
{% tab title="Typescript" %}

```typescript
const summary = analysisData?.privacySummary
if (summary) {
  console.log('Source:', summary.sourceUrl)
  console.log('Source last updated:', summary.sourceLastUpdated)
  for (const point of summary.bulletPoints) {
    console.log(`• ${point}`)
  }
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
if let summary = analysisData?.privacySummary {
    print("Source:", summary.sourceUrl)
    print("Source last updated:", summary.sourceLastUpdated ?? "unknown")
    for point in summary.bulletPoints {
        print("• \(point)")
    }
}
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
val summary = analysisData?.privacySummary
if (summary != null) {
    println("Source: ${summary.sourceUrl}")
    println("Source last updated: ${summary.sourceLastUpdated}")
    for (point in summary.bulletPoints) {
        println("• $point")
    }
}
```

{% endtab %}
{% endtabs %}

| Property            | Type                | Description                                                                 |
| ------------------- | ------------------- | --------------------------------------------------------------------------- |
| `bulletPoints`      | string\[]           | Up to 5 key takeaways.                                                      |
| `sourceUrl`         | string              | URL of the source material that was analyzed.                               |
| `sourceLastUpdated` | string \| undefined | When the source material was last updated, as reported by the organization. |

#### Organization Identity

When identified, the analysis includes the organization behind the domain — its consumer-facing brand, legal company name, and business categories.

{% tabs %}
{% tab title="Typescript" %}

```typescript
const identity = analysisData?.organizationIdentity
if (identity) {
  console.log('Brand:', identity.brandName)
  console.log('Company:', identity.companyName)
  console.log('Primary category:', identity.primaryCategory)
  console.log('Categories:', identity.categories.join(', '))
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
if let identity = analysisData?.organizationIdentity {
    print("Brand:", identity.brandName ?? "unknown")
    print("Company:", identity.companyName ?? "unknown")
    print("Primary category:", identity.primaryCategory.map(String.init(describing:)) ?? "unknown")
    print("Categories:", identity.categories.map(String.init(describing:)).joined(separator: ", "))
}
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
val identity = analysisData?.organizationIdentity
if (identity != null) {
    println("Brand: ${identity.brandName}")
    println("Company: ${identity.companyName}")
    println("Primary category: ${identity.primaryCategory}")
    println("Categories: ${identity.categories.joinToString(", ")}")
}
```

{% endtab %}
{% endtabs %}

| Property          | Type                    | Description                                          |
| ----------------- | ----------------------- | ---------------------------------------------------- |
| `brandName`       | string                  | The consumer-facing brand name of the organization.  |
| `companyName`     | string                  | The legal or corporate name of the organization.     |
| `primaryCategory` | OrganizationCategory    | The primary business category of the organization.   |
| `categories`      | OrganizationCategory\[] | All business categories the organization belongs to. |

#### Category Signals

Per-category breakdown of how specific types of personal data are handled. Each category includes signals for collection, sharing, monetization, retention, and opt-out capability.

{% tabs %}
{% tab title="Typescript" %}

```typescript
const categories = analysisData?.categories ?? []
for (const cat of categories) {
  console.log(`${cat.category}:`)
  console.log(`  Collected: ${cat.collected}`)
  console.log(`  Shared: ${cat.sharedWithThirdParties}`)
  console.log(`  Monetized: ${cat.monetized}`)
  console.log(`  Opt-out available: ${cat.userCanOptOut}`)
  if (cat.retention) {
    console.log(
      `  Retention: ${cat.retention.style}, ${cat.retention.timeInDays} days`,
    )
  }
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
let categories = analysisData?.categories ?? []
for cat in categories {
    print("\(cat.category):")
    print("  Collected: \(cat.collected)")
    print("  Shared: \(cat.sharedWithThirdParties)")
    print("  Monetized: \(cat.monetized)")
    print("  Opt-out available: \(cat.userCanOptOut)")
    if let retention = cat.retention {
        print("  Retention: \(retention.style), \(retention.timeInDays.map(String.init) ?? "n/a") days")
    }
}
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
val categories = analysisData?.categories ?: emptyList()
for (cat in categories) {
    println("${cat.category}:")
    println("  Collected: ${cat.collected}")
    println("  Shared: ${cat.sharedWithThirdParties}")
    println("  Monetized: ${cat.monetized}")
    println("  Opt-out available: ${cat.userCanOptOut}")
    cat.retention?.let { retention ->
        println("  Retention: ${retention.style}, ${retention.timeInDays} days")
    }
}
```

{% endtab %}
{% endtabs %}

| Property                 | Type                       | Description                                                       |
| ------------------------ | -------------------------- | ----------------------------------------------------------------- |
| `category`               | DataCategory               | The data category these signals apply to.                         |
| `collected`              | SignalValue                | Whether this category of data is collected.                       |
| `dataLabels`             | string\[]                  | Descriptive labels for the collected data within this category.   |
| `sharedWithThirdParties` | ShareStyle                 | How this category is shared with third parties.                   |
| `monetized`              | SignalValue                | Whether this category is used for monetization.                   |
| `retained`               | SignalValue                | Whether this category is retained.                                |
| `retention`              | RetentionInfo \| undefined | Retention details when data is retained.                          |
| `userCanOptOut`          | SignalValue                | Whether the user can opt out of this category's collection.       |
| `requiredForService`     | SignalValue                | Whether this data is required for the core service to function.   |
| `requiredForLaw`         | SignalValue                | Whether this data is collected to comply with legal requirements. |

**Data Categories:**

| Category            | Description                                               |
| ------------------- | --------------------------------------------------------- |
| `ACCOUNT_PROFILE`   | Account and profile information.                          |
| `AUTHENTICATION`    | Authentication credentials and tokens.                    |
| `BACKGROUND`        | Background/employment history.                            |
| `BIOMETRIC`         | Biometric data (fingerprints, face, voice).               |
| `COMMUNICATION`     | Communication content (messages, emails).                 |
| `CONTACTS`          | Contact lists and address books.                          |
| `DEMOGRAPHIC`       | Demographic information (age, gender).                    |
| `DEVICE_IDENTIFIER` | Device identifiers and hardware info.                     |
| `FINANCIAL`         | Financial data (payment methods, transactions).           |
| `GOVERNMENT_ISSUED` | Government-issued IDs (SSN, passport).                    |
| `HEALTH`            | Health and medical data.                                  |
| `INFERENCES`        | Inferred data derived from other categories.              |
| `LOCATION`          | Location and geolocation data.                            |
| `OTHER`             | Data not fitting other categories.                        |
| `PII`               | Personally identifiable information (name, email, phone). |
| `THIRD_PARTY_DATA`  | Data received from third parties.                         |
| `USAGE`             | Usage and behavioral data.                                |

**Signal Values:**

Most signals use a tri-state value:

| Value     | Description                            |
| --------- | -------------------------------------- |
| `YES`     | The determination is affirmative.      |
| `NO`      | The determination is negative.         |
| `UNKNOWN` | Insufficient information to determine. |

**Share Styles:**

The `sharedWithThirdParties` signal indicates how a category is shared:

| Style                 | Description                                               |
| --------------------- | --------------------------------------------------------- |
| `SHARED`              | Data is shared with third parties.                        |
| `SHARED_WITH_CONSENT` | Data is shared with third parties only with user consent. |
| `INFERENCE_SHARED`    | Inferred data is shared with third parties.               |
| `NONE`                | Data is not shared with third parties.                    |
| `UNKNOWN`             | Insufficient information to determine.                    |

#### Capability Signals

Action-derived signals indicating what privacy capabilities the organization supports.

{% tabs %}
{% tab title="Typescript" %}

```typescript
const capabilities = analysisData?.capabilities
if (capabilities) {
  console.log('Account creation:', capabilities.supportsAccountCreation)
  console.log('Account deletion:', capabilities.supportsAccountDeletion)
  console.log('Data deletion requests:', capabilities.supportsDataDeletionRequests)
  console.log('Data export:', capabilities.supportsDataExport)
  console.log('Subscriptions:', capabilities.supportsSubscriptions)
  console.log('Sells personal info:', capabilities.sellsPersonalInformation)
  console.log('Uses cookies/tracking:', capabilities.usesCookiesOrTracking)
  console.log('Two-factor auth:', capabilities.supportsTwoFactorAuth)
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
if let capabilities = analysisData?.capabilities {
    print("Account creation:", capabilities.supportsAccountCreation)
    print("Account deletion:", capabilities.supportsAccountDeletion)
    print("Data deletion requests:", capabilities.supportsDataDeletionRequests)
    print("Data export:", capabilities.supportsDataExport)
    print("Subscriptions:", capabilities.supportsSubscriptions)
    print("Sells personal info:", capabilities.sellsPersonalInformation)
    print("Uses cookies/tracking:", capabilities.usesCookiesOrTracking)
    print("Two-factor auth:", capabilities.supportsTwoFactorAuth)
}
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
val capabilities = analysisData?.capabilities
if (capabilities != null) {
    println("Account creation: ${capabilities.supportsAccountCreation}")
    println("Account deletion: ${capabilities.supportsAccountDeletion}")
    println("Data deletion requests: ${capabilities.supportsDataDeletionRequests}")
    println("Data export: ${capabilities.supportsDataExport}")
    println("Subscriptions: ${capabilities.supportsSubscriptions}")
    println("Sells personal info: ${capabilities.sellsPersonalInformation}")
    println("Uses cookies/tracking: ${capabilities.usesCookiesOrTracking}")
    println("Two-factor auth: ${capabilities.supportsTwoFactorAuth}")
}
```

{% endtab %}
{% endtabs %}

| Signal                         | Description                                                     |
| ------------------------------ | --------------------------------------------------------------- |
| `supportsAccountCreation`      | Whether the organization supports creating an account.          |
| `supportsAccountDeletion`      | Whether the organization supports account deletion.             |
| `supportsDataDeletionRequests` | Whether the organization accepts data deletion requests.        |
| `supportsDataExport`           | Whether the organization allows users to export their data.     |
| `supportsSubscriptions`        | Whether the organization supports subscription management.      |
| `sellsPersonalInformation`     | Whether the organization sells personal information.            |
| `usesCookiesOrTracking`        | Whether the organization uses cookies or tracking technologies. |
| `supportsTwoFactorAuth`        | Whether the organization supports two-factor auth for logins.   |

Each capability signal uses the same tri-state `SignalValue` (`YES` / `NO` / `UNKNOWN`) described above.

#### Risk Indicators

Aggregated risk indicators derived from category signals and capabilities.

{% tabs %}
{% tab title="Typescript" %}

```typescript
const risk = analysisData?.riskIndicators
if (risk) {
  console.log('Data categories collected:', risk.dataCollectionBreadth)
  console.log('Indefinite retention:', risk.hasIndefiniteRetention)
  console.log('Max retention (days):', risk.maxRetentionDays)
  console.log('Sells data:', risk.sellsPersonalInformation)
  console.log('Breach risk:', risk.breachRisk)
}
```

{% endtab %}

{% tab title="Swift" %}

```swift
if let risk = analysisData?.riskIndicators {
    print("Data categories collected:", risk.dataCollectionBreadth)
    print("Indefinite retention:", risk.hasIndefiniteRetention)
    print("Max retention (days):", risk.maxRetentionDays.map(String.init) ?? "n/a")
    print("Sells data:", risk.sellsPersonalInformation)
    print("Breach risk:", risk.breachRisk)
}
```

{% endtab %}

{% tab title="Kotlin" %}

```kotlin
val risk = analysisData?.riskIndicators
if (risk != null) {
    println("Data categories collected: ${risk.dataCollectionBreadth}")
    println("Indefinite retention: ${risk.hasIndefiniteRetention}")
    println("Max retention (days): ${risk.maxRetentionDays}")
    println("Sells data: ${risk.sellsPersonalInformation}")
    println("Breach risk: ${risk.breachRisk}")
}
```

{% endtab %}
{% endtabs %}

| Indicator                                      | Type                | Description                                                            |
| ---------------------------------------------- | ------------------- | ---------------------------------------------------------------------- |
| `dataCollectionBreadth`                        | number              | Total number of data categories collected.                             |
| `collectsSensitiveDataForNonEssentialPurposes` | SignalValue         | Whether sensitive categories are collected for non-essential purposes. |
| `sellsPersonalInformation`                     | SignalValue         | Whether data selling is indicated.                                     |
| `maxRetentionDays`                             | number \| undefined | Longest known retention period in days.                                |
| `hasIndefiniteRetention`                       | SignalValue         | Whether any category has indefinite retention.                         |
| `encryptionPractices`                          | SignalValue         | Whether strong encryption practices are in place.                      |
| `breachRisk`                                   | SignalValue         | Whether there is an elevated risk of data breach.                      |

#### Retention Styles

When retention information is available for a category, the `style` field indicates how the retention period is expressed:

| Style                              | Description                                             |
| ---------------------------------- | ------------------------------------------------------- |
| `INDEFINITE`                       | Data is retained indefinitely with no defined end date. |
| `RELATIVE_TO_ACCOUNT_CLOSURE_TIME` | Retention period starts when the account is closed.     |
| `RELATIVE_TO_DATA_STORAGE_TIME`    | Retention period starts when the data is stored.        |
| `OTHER`                            | Retention policy does not fit standard categories.      |

`RetentionInfo` carries the `style`, an optional `timeInDays`, and optional free-text `additionalInfo` from the policy.

#### Analysis Data Object

| Property               | Type                              | Description                                                       |
| ---------------------- | --------------------------------- | ----------------------------------------------------------------- |
| `privacyScore`         | PrivacyScore \| undefined         | Overall privacy score. Undefined when scoring is disabled.        |
| `privacySummary`       | PrivacySummary                    | Concise human-readable summary of privacy findings.               |
| `categories`           | CategorySignals\[]                | Per-category signal breakdown.                                    |
| `capabilities`         | CapabilitySignals                 | Action-derived capability signals.                                |
| `riskIndicators`       | RiskIndicators                    | Aggregated risk indicators.                                       |
| `organizationIdentity` | OrganizationIdentity \| undefined | Organization identity (brand, company, business categories).      |
| `attribution`          | string\[]                         | Information describing where the analysis result is derived from. |