Endpoint Agent
Runs on every device. Guards clipboard, USB, print, screenshot, file-save and image-open, with on-device OCR.
Data Loss Prevention
Prevent sensitive data leakage across all enterprise channels.
One cross-platform agent for Windows, Linux and macOS guards clipboard, USB, print, screenshot, files, web, email, AI tools and messengers — enforcing at the operating-system layer, before anything is encrypted.
The problem
Sensitive data leaks through every exit ramp.
Classic DLP watches the network wire. But data leaves through a dozen channels the network never sees — and the hardest one, end-to-end encrypted messengers, is opaque ciphertext by the time it hits the wire.
By the time encrypted upload traffic reaches a network DLP, the file is already ciphertext — nothing to inspect, nothing to block. Data Loss Prevention moves enforcement to the endpoint, before encryption.
The solution
One agent. Every exit ramp. Real time.
Windows · Linux · macOS
Architecture
Three enforcement modules, one shared brain.
Write the rule once — enforce everywhere. All three modules read from a single pattern catalogue, and every finding lands in one console.
Email Gateway
Inline email redact, quarantine or reject — plus a browser compose-window filter for Gmail, Outlook and Office 365.
Network Sensor
Inspects encrypted web traffic on the device — blocks uploads to messaging, cloud and paste sites, and redacts AI prompts.
Shared pattern catalogue
32+ detectors · 25 countries
Prebuilt detectors for card numbers, national IDs and account data.
Checksum-validated
Random digit strings never raise a false alarm.
Custom rules, instant updates
Regex editor with a test sandbox; changes propagate in seconds.
Kernel-enforced protection
Blocked before any application can read it.
Built into the operating system, Data Loss Prevention stops sensitive data before an application can move it — which is why it cannot simply be bypassed.
Image-open block
A photo containing card or ID data is checked on the device before it opens — it never appears on screen if it is sensitive. Works in any viewer.
File-save block
Saving a card or ID number to a file is blocked the instant you try — the data never reaches the disk.
Instant clipboard wipe
Sensitive data is cleared the moment it is copied — no window in which to paste it somewhere it should not go.
Print guard
Sensitive content closes the print dialog on every path — keyboard shortcut and File → Print alike.
Flagship differentiator
Block WhatsApp, Telegram and Signal leaks.
Most DLP fails here — these apps encrypt the file on the device, so the network only sees scrambled data. We close the gap with three independent layers; all three must be beaten to leak a file.
1
Browser layer
Catches files in the browser — file picker, drag-drop or paste — before the web app can read them. Blocks 20+ high-risk sites.
2
Network layer
Blocks uploads to messaging and file-sharing sites at the network layer — even when the file is encrypted.
3
Screen-guard layer
Reads the chat window on screen to catch sensitive text typed or pasted into a message before it is sent.
20+ hosts including WhatsApp · Telegram · Signal · Messenger · Discord · Dropbox · MEGA · WeTransfer · Pastebin
GenAI protection
Stop secrets leaking into AI tools.
Employees paste customer data into ChatGPT, Claude and Gemini every day. We inspect the prompt on the device — before it ever reaches the AI provider.
Prompt-leak blocking
Sensitive text or images typed or pasted into ChatGPT, Claude, Gemini, Copilot and Perplexity are caught and blocked before the prompt is sent.
AI-reply redaction
If the model echoes back a card or ID number, it is masked on screen — the user sees a redaction, never the secret itself.
Vendor-aware inspection
Understands each AI's API shape, so prompts hidden inside streaming JSON bodies are still extracted and checked — not just plain text boxes.
On-device, encryption-proof
Enforced in the browser and at the network layer on the endpoint, so it still works even though all AI traffic is HTTPS-encrypted.
Coverage
Every channel a leak can take.
Detection & compliance
Accurate detectors, regulator-ready evidence.
0+
Built-in detectors
0
Countries covered
0
False positives on checksum-validated IDs*
*Card and ID numbers are checksum-validated, so random digit strings never raise a false alarm.
Maps out of the box to:
GDPRPCI-DSSHIPAA
PDPAIndia DPDPSOXISO 27001
Tamper-proof audit log — evidence for every finding (file, user, time, action, masked match). Raw personal data never leaves your database.
Rollout
Three enforcement modes, hot-reloaded per endpoint.
Audit-only
Watch and log, block nothing. Prove ROI before a single user feels a block.
Selective
Silently redact or wipe. Sensitive content vanishes; workflows continue.
Strict
Hard-block with a user popup. Kernel-enforced denial with an on-screen notice.
Mode changes propagate via heartbeat in seconds — no agent re-install, no user logout.
Live console
A single pane of glass over the fleet.
- Real-time finding stream
- Drill-down by endpoint, channel, detector and time
- Custom-pattern editor with a regex test sandbox
- USB device-fingerprint registry
- Fleet geo-map and geofence policies
- Exportable per-policy reports
Centralized group-based policy
Organise endpoints the way the business is organised.
First-class groups
Create departments — Finance, Executive, Engineering — colour-code them, and see member-device and policy counts at a glance.
One policy, many groups
Bind one detector profile to several departments at once. Edit the rule once and every group it covers updates live.
One-screen assignment
Move endpoints into a group from a single screen. A device's department decides which policy it enforces.
Rename-safe by design
Groups bind by stable ID, so a rename never breaks enforcement — and the Default baseline cannot be deleted while in use.
Forensic visibility
See where sensitive data already lives.
- Baseline scan on install — auto-fires on first deploy and surfaces existing exposure across the fleet.
- Five source-grouped tabs — Triggered Scan, Clipboard, Web Intercept, OCR Engine and USB Restriction.
- Evidence per finding — path, user, timestamp, action and masked preview, exportable for regulators.
Why Data Loss Prevention
What sets it apart.
E2E messenger coverage
Stops leaks through apps most DLP cannot reach.
Kernel-enforced blocking
Blocks at the OS layer — it cannot be bypassed.
OCR built for cards & IDs
Reads tilted, low-contrast camera shots.
One agent, three OSes
Windows, Linux and macOS — one agent.
Instant policy updates
Rule and mode changes take effect in seconds.
Audit-first rollout
Prove ROI before anyone feels a block.
Ready to close the gaps others miss.
Start in audit-only mode. The baseline scan alone usually surprises people — then you decide what to enforce.