Supported File Formats

Connect a system and Classifyre reads what’s actually in it — not just the plain text. The scanned contract, the spreadsheet attached to a ticket, the screenshot pasted into a chat thread, the images packed inside a dataset: each becomes content your detectors can search.

This page answers the two questions that come up first: what can Classifyre read, and which sources do those files come from?

The format is worked out from the file’s contents, not just its name — so a mislabelled export, a file with no extension, or a document a system reports as “binary” is still read as what it really is. That matters in practice: cloud storage tends to label almost everything as generic binary data.

Which file formats does Classifyre support?

Images, audio, and video need OCR and transcription switched on for the source — they’re off by default because they cost more time per item than reading text.

Source code and configuration

Code files are read as the text they are, so a key committed to config/settings.py, a password in values.yaml, or a live token in .env is found the same way one in a spreadsheet is. Roughly eighty extensions are recognised, plus the files that carry no extension at all — Dockerfile, Makefile, Jenkinsfile, Gemfile, .env.production.

This matters more than it sounds. A Python module whose first line is from typing import Any, Dict, List has two commas on line one, which is exactly what a spreadsheet’s header row looks like — and a minified JavaScript bundle starts with {, which is exactly what a JSON file looks like. Read by content alone, both get sent to a table reader that produces columns of nonsense and finds nothing. Classifyre uses the file name to settle it, so the file is read line by line as source.

The most common places a real credential turns up are the ones you would expect: .env and its per-environment variants, Terraform variable files, CI pipeline definitions, Kubernetes manifests, and connection strings in application config. All of them are read.

Files hidden inside other files

A lot of sensitive data doesn’t sit in a file — it sits in a file inside a file. Classifyre unpacks those and treats each one as a separate asset, with its own detectors, findings, and link back to the file it came from.

In the row text, an embedded file shows up as a compact placeholder such as <image: 41 KB> — the bytes themselves are scanned as their own asset, so a passport photo in row 4,000,001 gets flagged as an image finding rather than disappearing into a wall of unreadable characters.

Two things worth knowing:

• Unpacking happens for file-based sources — cloud storage, local folders, direct uploads, Dropbox, and Hugging Face. A ZIP attached to a Jira ticket is catalogued and tracked, but its contents aren’t split out.
• Unpacking follows your sampling settings — the files inside the rows a run reads become assets on that run. Fan-out is capped per file, so one dataset can’t turn into a million assets overnight.

Large files and very big tables

Big files aren’t truncated, and they aren’t loaded into memory whole. Classifyre streams them, so a multi-gigabyte export is read the same way a small one is.

For anything with rows — CSV, Parquet, Arrow, spreadsheets, database tables — your sampling strategy also governs how much of each file a single run reads:

With Automatic, a 40-million-row Parquet file is covered slice by slice across scheduled runs instead of blocking one enormous scan, and progress is tied to the file’s contents — if the file changes, the sweep restarts rather than resuming into rows that have moved.

For Parquet and Arrow files held in cloud storage, only the part of the file a run actually needs is fetched. A multi-gigabyte dataset shard can be scanned without ever being downloaded in full — which is what keeps egress costs and scan times predictable on large data lakes.

Which sources do files come from?

Everything above applies to these sources — this is where documents, images, media, and archives enter Classifyre.

Sources that bring records rather than files

These systems produce rows and documents instead of files. They’re read directly — no file parsing involved — and the same sampling controls apply.

The full, always-current list — with every configuration field per system — is in the source catalog.

Controlling what gets picked up

Reading everything is rarely what you want. Most file-based sources let you restrict the scan before anything is downloaded:

• By file type — include or exclude extensions, so a bucket of build artefacts doesn’t consume a scan meant for documents.
• By path — pattern filters such as data/**/*.parquet on object storage.
• By scope — specific folders, projects, channels, labels, or mailboxes, depending on the system.

Filtering by name is far cheaper than downloading and discarding, so it’s the first lever to reach for on a large source. See Configuration & Fields for what each source supports.

Common questions

Does Classifyre read scanned PDFs? Yes. PDFs with a text layer are read directly; pages that are images get OCR, so scanned contracts and faxes are searchable. Turn on OCR for the source.

Can it read files inside a ZIP? Yes — for file-based sources, each file in the archive becomes its own asset with its own findings. Archives nested inside archives are catalogued but not opened recursively.

Does it handle Parquet and Arrow datasets? Yes, row by row, including columns that hold whole files such as images or documents. Large shards in cloud storage are read in place rather than downloaded.

Does it read source code? Yes — around eighty languages and configuration formats, plus extension-less files such as Dockerfile and Makefile. Each is read line by line as text, so a secret in a config file is found the same way one in a document is.

What about audio and video? Both are transcribed, and video also has the text on screen read via OCR. Enable transcription on the source.

Will very large files break a scan? No. Files are streamed rather than loaded whole, and tables are read in bounded slices set by your sampling strategy.

What happens to a file type that isn’t supported? It’s still catalogued with its metadata and tracked across scans — it simply has no text for detectors to read.

Next steps

• Decide how much of each source to read — Sampling Strategies
• Unlock images, audio, and video — OCR & Transcription
• See what a scan produces — Assets & Metadata
• Browse every connector — Source Catalog