A method and system of scanning a client for sensitive data. A server may receive, from the client, a request to scan the data stored in the data storage of the client for sensitive data. In response to receiving the request, the server may provide the client with a scanner, which causes the client to carry out functions including: (a) scanning the data stored in data storage to identify sensitive data; (b) collecting data based on the identified sensitive data; and (c) reporting the collected data. The server may then receive the collected data from the client and responsively analyze the data. The server may also provide feedback about the identified sensitive data to the client or another server.