Data Classification helps organizations identify the types of data an application may process.

Each application can have one or more data classifications, such as:

• Financial Data
• HR Data
• Analytics Data

These classifications provide additional business and compliance context for applications discovered in AppNavi. They can be used to identify applications that handle sensitive information, support risk assessments, plan security and compliance reviews, and filter and manage applications in Discovery.

Why Data Classification Matters

Application usage alone does not tell you what type of information may be processed by an application.

For example, two applications may have a similar number of users but require very different governance reviews:

Data Classification adds this business context to the application inventory.

It can help teams answer questions such as:

• Which applications may process HR information?
• Which applications may handle financial information?
• Which discovered applications require additional compliance review?
• Which applications should be included in a security or privacy assessment?

The classification itself does not determine whether an application is approved, compliant, or unsafe. It provides information that can be used as part of those assessments.

How Data Classification Works

AppNavi uses two levels of Data Classification:

SaaS Catalog classification → Discovered App classification

The first provides an initial classification automatically when AppNavi recognizes an application. The second allows authorized users to review and maintain the classification for the discovered application.

1. Catalog-Level Classification

Before an application appears in Discovery, AppNavi checks the application against its predefined SaaS Catalog.

If the application is recognized and the catalog contains Data Classification information, the corresponding classifications are automatically populated when the application is discovered.

This provides:

• Consistent initial values
• Less manual classification work
• A useful starting point for newly discovered applications

Example

Suppose an employee starts using a recognized payroll application.

AppNavi identifies the application in the SaaS Catalog and the catalog contains:

Financial Data
HR Data

When the application appears in Discovery, these classifications can already be available for the application.

The administrator can then review the classification against the organization's actual use of the application.

2. Discovered App-Level Classification

After an application appears in Discovery, users can manually change or adjust its Data Classification.

The Data Classification field supports multiple selections, so an application can have more than one classification.

For example:

HR Data + Financial Data

can be assigned to an application used for employee payroll.

Important Behavior After Manual Editing

Once a user edits the Data Classification for a discovered application, the value becomes user-controlled.

Future updates to the SaaS Catalog will not overwrite the classification that was manually maintained for that application.

This allows organizations to maintain classifications according to their own business context.

Who Maintains Data Classification?

Data Classification has two sources:

This means customers do not need to manually classify every recognized application from the beginning.

Instead, the recommended approach is:

Use the catalog classification as a starting point → Review it → Adjust it when necessary → Maintain the application-level value

Once the customer changes the value, future catalog updates do not replace that customer-maintained classification.

Recommended Classification Workflow

A practical workflow is:

Discover application → Check automatic classification → Review actual business use → Adjust classification if required → Save → Use classification for risk/compliance analysis

Step 1 — Discover the Application

The application first becomes available through AppNavi Discovery.

Discovery collects application information and usage data from the configured Discovery data source.

For Chrome Extension-based Discovery, available application information can include application URL, user, country, session, timestamp, activity time, and other application metadata.

Step 2 — Check the Initial Classification

Open the discovered application's details and review the Data Classification field.

If the application was recognized by the SaaS Catalog, the field may already contain one or more classifications.

Step 3 — Compare the Classification With Actual Usage

Do not assume that the catalog classification always represents how your organization uses the application.

For example, a SaaS application may support:

• HR
• Finance
• Analytics

but your organization may use it only for HR information.

Review the actual business use before deciding whether the existing classification should be changed.

Step 4 — Adjust the Classification

If the existing classification does not represent the application's use in your organization, update the Data Classification field.

Because the field supports multiple selections, select all applicable classifications.

Step 5 — Save the Application

Save the application after making the required changes.

The application-level classification becomes user-controlled after it has been edited.

Step 6 — Use the Classification in Reviews

The classification can then provide context for:

• Risk assessments
• Compliance reviews
• Security reviews
• Privacy reviews
• Discovery analysis
• Application governance

Concrete Classification Examples

Example 1 — Payroll Application

Application

Employee Payroll

Classification

• Financial Data
• HR Data

Why

The application may process employee salary and employment information.

Governance Use

A security or compliance team may include the application in reviews involving employee and financial information.

---

Example 2 — Customer Analytics Platform

Application

Customer Analytics

Classification

• Analytics Data
• Customer Data

Why

The application is used to analyze customer-related information.

Governance Use

The organization may review the application for data protection requirements and determine whether additional controls are needed.

---

Example 3 — Internal Project Management Tool

Application

Project Management

Classification

• General Business Data

Why

The application is primarily used to coordinate projects and tasks.

Governance Use

The application can still be included in the application inventory, but its data classification provides additional context when prioritizing reviews.

---

Example 4 — One Application With Multiple Classifications

An application can have multiple classifications.

For example:

HR Data + Financial Data + Analytics Data

This may be appropriate when the application supports employee reporting, payroll-related information, and analytics.

The multi-select behavior allows the classification to represent more than one type of data handled by an application.

How Discovered Apps Use Data Classification

Data Classification becomes part of the application's Discovery information.

The Discovery application data model includes a Data Classification field and a corresponding Data Classification Names field.

Recognized SaaS applications can inherit Data Classification information from the SaaS Catalog.

The broader catalog inheritance model also includes application information such as:

• Title
• Vendor
• Category
• Privacy Policy
• Terms of Service
• Sensitive Data
• AI Productivity Tool
• Data Classification
• Business Capability
• SaaS metadata

This allows a recognized application to enter Discovery with useful standardized metadata rather than requiring every field to be entered manually.

What Happens When a Catalog Application Is Discovered?

The process can be understood as:

Application discovered → AppNavi identifies SaaS Catalog match → Catalog classification is applied → Application appears in Discovery → Customer reviews classification → Customer can adjust classification

For example:

An employee uses a known HR SaaS application.

AppNavi recognizes the application.

The SaaS Catalog provides:

HR Data

The application appears in Discovery with that classification.

The customer reviews how the application is actually used and determines that it also processes financial information.

The customer changes the classification to:

HR Data + Financial Data

From that point, the classification is user-controlled and future catalog updates do not overwrite the customer's change.

How Data Classification Supports Risk Management

Data Classification can be used as an input when assessing application risk.

For example:

Application A

• HR Data
• Financial Data
• 500 users

Application B

• General Business Data
• 20 users

Both applications may require governance, but the first may require additional attention because its classification indicates that it processes employee and financial information.

Data Classification therefore helps provide context for risk assessment.

It does not automatically determine the risk level of the application.

Risk assessments should also consider other available application information and the organization's own policies.

How Data Classification Supports Compliance

Data Classification can support compliance workflows by helping teams identify applications associated with specific types of information.

For example, a compliance team may want to review applications classified as:

HR Data

The team can then investigate:

• What information is processed?
• Who uses the application?
• Where is the data hosted?
• Is the application approved?
• What security controls are required?
• Does the application meet applicable organizational or regulatory requirements?

The Data Classification feature is intended to support compliance needs such as ISO 27001, GDPR, and general internal governance.

The classification itself should not be interpreted as proof that an application is compliant with a particular regulation or standard.

How Data Classification Works With Discovery Risk Information

Data Classification is one part of a broader application information set in Discovery.

Other available fields can include:

• Criticality Level
• Primary Data Location
• Sensitive Data / PII
• PII Inflow Risk
• PII Outflow Risk
• AI Productivity Tool
• SSO Usage
• Business Process
• Business Capability
• Data Classification

These fields provide different types of context about an application.

For example:

Together, these fields provide a broader basis for application governance.

Data Classification and Discovery Reports

Data Classification is also available in Discovery reporting.

The Data Flow / Compliance Report includes a Data Classification field describing the category of data handled by the application, with examples such as HR, Financial, and Customer data.

This allows teams to use classification information outside the application details page.

For example, a compliance review could use the report to identify applications associated with specific data categories and then investigate those applications further.

Example Compliance Workflow

Generate Data Flow / Compliance Report → Identify applications with relevant classifications → Review application details → Assess data handling → Perform required compliance review → Record or remediate findings

Filtering and Managing Applications

Data Classification helps teams filter and manage applications efficiently within Discovery.

For example, an organization reviewing HR-related applications can focus its investigation on applications classified as:

HR Data

The exact filtering options available depend on the Discovery view or report being used.

Do not assume that every Discovery screen provides the same filtering controls.

Data Classification and Shadow IT

Data Classification can also provide useful context when reviewing Shadow IT.

Consider this example:

Shadow application: Online file-sharing service
Users: 75
Department: Finance
Classification: Financial Data

The combination of Shadow IT status and Financial Data classification provides a reason for the application to be investigated through the organization's governance process.

A governance team can then review:

1. Who is using the application?
2. What information is being processed?
3. Is the application approved?
4. Where is the data stored?
5. Are appropriate security controls available?
6. Should the application be approved, restricted, or otherwise managed?

Data Classification supports this investigation but does not automatically determine the final governance decision.

Data Classification and Demo Data

If you want to explore Data Classification without using live Discovery data, AppNavi provides Discovery Demo Data.

After importing the demo data, discovered and company applications are populated with realistic sample information, including:

• Data Classification
• Business Process
• PII Inflow Risk
• PII Outflow Risk
• Business Capability
• User metrics
• Country
• Department
• Organizational Unit

This allows teams to see how Data Classification appears alongside other Discovery information before working with production data.

Example: End-to-End Governance Review

Consider an application discovered in the Finance department.

Discovery

The application is identified through App Discovery.

Automatic Classification

The SaaS Catalog identifies the application and provides:

Financial Data

Customer Review

The customer determines that employees also use the application to process customer information.

The classification is changed to:

Financial Data + Customer Data

Risk Review

The team reviews additional application information:

• Criticality
• Data location
• Sensitive data
• PII indicators
• Business process
• Business capability

Compliance Review

The application is included in the appropriate privacy or compliance review.

Reporting

The application can also appear with its classification in relevant Discovery reporting.

This creates a traceable workflow:

Discovery → Classification → Review → Risk/Compliance Assessment → Governance Action

Important Behavior to Remember

Catalog Values Are Initial Values

Catalog-level classification provides the initial classification for recognized applications.

Users Can Change Classification

Users can manually change or adjust the classification after the application appears in Discovery.

Multiple Classifications Are Supported

An application can have more than one Data Classification.

Manual Changes Are Preserved

Once a user edits the Data Classification, it becomes user-controlled and future catalog updates do not overwrite that value.

Classification Is Not a Compliance Decision

A classification such as Financial Data or HR Data describes the type of information associated with an application. It does not by itself mean that the application is compliant or non-compliant.