Analysis Results

An analysis result contains a structured privacy analysis for a specific data holder. Analysis results are generated automatically as data holders are discovered.

Each analysis result summarizes how an organization collects, retains, and shares user data based on their publicly available privacy policy and other documents.

Listing Analysis Results

To retrieve all analysis results associated with a specific virtual presence, use the listAnalysisResults method. Results are paginated.

A call to listAnalysisResults returns a ListOutput object containing a list of matching items and a nextToken to support pagination. If no results are found, the result will contain empty items. Always check the value of the returned nextToken since there are more results to retrieve when nextToken is defined.

try {
  let nextToken: string | undefined = undefined
  do {
    const listOutput = await privacyInteractionClient.listAnalysisResults({
      virtualPresenceId: 'virtual-presence-id',
      limit: 20,
      nextToken,
    })

    for (const analysisResult of listOutput.items) {
      console.log(analysisResult.dataHolderIdentifier, analysisResult.status)
    }

    nextToken = listOutput.nextToken
  } while (nextToken !== undefined)
} catch (error) {
  // Handle/notify user of errors
}

Input Parameters:

Parameter	Type	Required	Description
virtualPresenceId	string	Yes	The identifier of the virtual presence to list analysis results for.
limit	number	No	Maximum number of items to return. Will be defaulted if omitted.
nextToken	string	No	A pagination token from a previous call.

Retrieving an Analysis Result

To retrieve a full analysis result by its unique identifier, use the getAnalysisResult method. This returns the analysis result if it exists, or undefined if not found. Analysis result identifiers will be provided in subscription update notifications, or can be retrieved from the listAnalysisResults method.

Typescript

try {
  const analysisResult = await privacyInteractionClient.getAnalysisResult(
    analysisResultId,
  )
  if (analysisResult) {
    console.log(analysisResult.status)
    if (analysisResult.data) {
      console.log('Privacy score:', analysisResult.data.privacyScore?.score)
      console.log('Summary:', analysisResult.data.privacySummary.bulletPoints)
    }
  }
} catch (error) {
  // Handle/notify user of errors
}

The data field is populated when the analysis result status is COMPLETE or PARTIAL. For other statuses, data will be undefined.

Analysis Result Status

An analysis result transitions through the following statuses:

Status	Description
PENDING	The analysis is queued but has not yet started.
COMPLETE	The analysis has completed successfully with full data.
PARTIAL	The analysis has completed with partial data available.
FAILED	The analysis encountered an error and could not complete.
UNAVAILABLE	The analysis data is not available for this data holder.

Analysis Result Data

When an analysis result reaches COMPLETE or PARTIAL status, the data field contains the structured analysis payload:

Privacy Score

The privacy score provides an overall numeric assessment (0–100) of the organization's privacy practices. A higher score indicates better privacy practices.

Typescript

if (analysisResult.data?.privacyScore) {
  const { score, breakdown } = analysisResult.data.privacyScore
  console.log(`Overall score: ${score}/100`)
  for (const contribution of breakdown) {
    console.log(`  ${contribution.aspect}: ${contribution.contribution}`)
  }
}

Privacy Summary

A concise human-readable summary of privacy findings, including up to 5 key takeaways. An example of this might be:

• Collects 13 categories of personal data including location data, biometric data, background check data and 10 other categories.

• Collects sensitive data (location data) for non-essential purposes.

• Shares location data, other data, personal identifiers and 7 more with third parties.

• Sells personal information (opt-out available).

• Uses location data, other data, personal identifiers and 4 more for advertising.

Typescript

const summary = analysisResult.data?.privacySummary
if (summary) {
  console.log('Source:', summary.sourceUrl)
  for (const point of summary.bulletPoints) {
    console.log(`• ${point}`)
  }
}

Category Signals

Per-category breakdown of how specific types of personal data are handled. Each category includes signals for collection, sharing, advertising use, retention, and opt-out capability.

Typescript

const categories = analysisResult.data?.categories ?? []
for (const cat of categories) {
  console.log(`${cat.category}:`)
  console.log(`  Collected: ${cat.collected}`)
  console.log(`  Shared: ${cat.sharedWithThirdParties}`)
  console.log(`  Used for ads: ${cat.usedForAdvertising}`)
  console.log(`  Opt-out available: ${cat.userCanOptOut}`)
  if (cat.retention) {
    console.log(`  Retention: ${cat.retention.style}, ${cat.retention.timeInDays} days`)
  }
}

Data Categories:

Category	Description
ACCOUNT_PROFILE	Account and profile information.
AUTHENTICATION	Authentication credentials and tokens.
BACKGROUND	Background/employment history.
BIOMETRIC	Biometric data (fingerprints, face, voice).
COMMUNICATION	Communication content (messages, emails).
CONTACTS	Contact lists and address books.
DEMOGRAPHIC	Demographic information (age, gender).
DEVICE_IDENTIFIER	Device identifiers and hardware info.
FINANCIAL	Financial data (payment methods, transactions).
GOVERNMENT_ISSUED	Government-issued IDs (SSN, passport).
HEALTH	Health and medical data.
INFERENCES	Inferred data derived from other categories.
LOCATION	Location and geolocation data.
OTHER	Data not fitting other categories.
PII	Personally identifiable information (name, email, phone).
THIRD_PARTY_DATA	Data received from third parties.
USAGE	Usage and behavioral data.

Signal Values:

Each signal uses a tri-state value:

Value	Description
YES	The determination is affirmative.
NO	The determination is negative.
UNKNOWN	Insufficient information to determine.

Capability Signals

Action-derived signals indicating what privacy capabilities the organization supports.

Typescript

const caps = analysisResult.data?.capabilities
if (caps) {
  console.log('Account deletion:', caps.supportsAccountDeletion)
  console.log('Data deletion requests:', caps.supportsDataDeletionRequests)
  console.log('Data export:', caps.supportsDataExport)
  console.log('Sells personal info:', caps.sellsPersonalInformation)
  console.log('Uses cookies/tracking:', caps.usesCookiesOrTracking)
}

Signal	Description
supportsAccountDeletion	Whether the organization supports account deletion.
supportsDataDeletionRequests	Whether the organization accepts data deletion requests.
supportsDataExport	Whether the organization allows users to export their data.
sellsPersonalInformation	Whether the organization sells personal information.
usesCookiesOrTracking	Whether the organization uses cookies or tracking technologies.

Risk Indicators

Aggregated risk indicators derived from category signals and capabilities.

Typescript

const risk = analysisResult.data?.riskIndicators
if (risk) {
  console.log('Data categories collected:', risk.dataCollectionBreadth)
  console.log('Indefinite retention:', risk.hasIndefiniteRetention)
  console.log('Max retention (days):', risk.maxRetentionDays)
  console.log('Sells data:', risk.sellsPersonalInformation)
  console.log('Breach risk:', risk.breachRisk)
}

Indicator	Type	Description
dataCollectionBreadth	number	Total number of data categories collected.
collectsSensitiveDataForNonEssentialPurposes	SignalValue	Whether sensitive categories are collected for non-essential purposes.
sellsPersonalInformation	SignalValue	Whether data selling is indicated.
maxRetentionDays	number | undefined	Longest known retention period in days.
hasIndefiniteRetention	SignalValue	Whether any category has indefinite retention.
encryptionPractices	SignalValue	Whether strong encryption practices are in place.
breachRisk	SignalValue	Whether there is an elevated risk of data breach.

Retention Styles

When retention information is available for a category, the style field indicates how the retention period is expressed:

Style	Description
INDEFINITE	Data is retained indefinitely with no defined end date.
RELATIVE_TO_ACCOUNT_CLOSURE_TIME	Retention period starts when the account is closed.
RELATIVE_TO_DATA_STORAGE_TIME	Retention period starts when the data is stored.
OTHER	Retention policy does not fit standard categories.

Analysis Result Object

Property	Type	Description
id	string	Unique identifier for the analysis result.
owner	string	Unique identifier of the user.
virtualPresenceId	string	The virtual presence this analysis is associated with.
dataHolderIdentifier	string	The data holder domain this analysis is about.
status	AnalysisResultStatus	Current status of the analysis.
lastAnalyzedAt	Date	When the analysis was last performed.
data	AnalysisResultData | undefined	Structured analysis data (populated when status is COMPLETE or PARTIAL).
version	number	Entity version, increments on update.
createdAt	Date	When the analysis result was created.
updatedAt	Date	When the analysis result was last updated.

Subscribing to Analysis Result Updates

To receive real-time notifications when analysis results are created, change status or are updated, see Subscriptions.