Data stops where your policy says it stops.
One policy covers the clipboard, USB drives, printers, email, browser uploads and AI prompts. Tracemark reads the content, decides on the device, and keeps the evidence.
Every way data leaves a company.
Each channel is checked where the action happens: on the device, in the mail client, in the browser. The same detectors and the same policy apply to all of them.
Clipboard
Copy and paste between any two applications, checked before the paste lands.
Files and USB drives
Copies to removable drives and network shares, judged by what the file contains rather than its name.
Print jobs from any application, with the document's label taken into account.
Outlook, Outlook on the web and Exchange, before the message is sent.
Browser uploads
Files and pasted text going to websites and web apps.
AI prompts
Text and files sent to AI assistants, blocked or masked before they leave.
Screen
Screenshots and recording of labelled documents.
Network
The same policy applied to outbound network traffic.
It knows what the content is.
Built-in detectors find card numbers, national IDs, IBANs and more. Weak signals such as a 16-digit number need nearby keywords or structure before they count, which keeps false alarms down.
- Exact data match. Match real records from your own databases, so only your customers' data triggers.
- Document fingerprints. Register a contract or a price list and catch copies and excerpts of it.
- Text in images. Screenshots, photos and scanned PDFs are read and checked like any document.
- Your own categories. Add keywords and patterns for data only your company has.
The right response for each risk.
Not every match deserves a block. Choose per policy, per channel and per label.
Allow and record
Learn how data actually moves before you enforce anything.
Warn
Coach people at the moment of risk and let them decide.
Ask for a reason
Exceptions are explained in the person's own words and can be reviewed later.
Block
What must never leave does not leave, and the person is told why.
From an action to evidence.
What happens on the device each time someone copies, saves, prints, sends or uploads.
Action
Someone copies, saves, prints, sends or uploads.
Inspect
The agent extracts the content and runs the detectors.
Decide
The policy for this user, device and label picks a response.
Respond
The person sees why, and what they can do instead.
Record
An incident with its evidence lands in the console.
What is included.
Data Loss Prevention is a set of modules on one engine. Turn on the ones you need.
The agent watches the clipboard, file copies, removable media, printing and browser uploads, and applies the policy on the device itself.
- Clipboard between any two applications
- Copies to USB drives and network shares
- Printing from any application
- Uploads through Chrome, Edge and Firefox
- Enforcement while offline
- Clipboard protection on macOS and Linux too
Messages and attachments are checked before they are sent: in Outlook, in Outlook on the web and at the Exchange server.
- Body, subject and attachments
- Internal and external recipients told apart by your domains
- A label asked for on send when one is missing
- Block, warn or ask for a reason
The same detectors applied to outbound traffic, for data that leaves by a path no endpoint agent sees.
- Shared detectors and policies
- Incidents in the same queue as endpoint and email
Load records from your own systems. A random number that looks like a card does not trigger; your customer's real card does.
- Customer, employee and account records
- Registered documents and their excerpts
- Values stored as fingerprints, not as plain text
Text inside an image is still text. Screenshots, phone photos and scanned PDFs are read and checked like any document.
- Common image formats
- Scanned PDFs
- The same detectors as for text
Someone who copies five records a day for a month never trips a single rule. Cumulative detection adds the small actions up and raises an incident when the total crosses your threshold.
- Per-user totals over a time window
- Counted across channels
Start from ready-made policies for common kinds of data, then adjust thresholds, channels and responses.
- Financial, personal and health data
- Audit first, enforce when ready
- Allow lists for trusted destinations
What is checked, and where.
| Channel | What is inspected | Where it runs |
|---|---|---|
| Clipboard | Copied text before it is pasted | Windows, macOS, Linux |
| Files and USB | File content on copy to removable drives and shares | Windows |
| Print jobs and the document label | Windows | |
| Body, subject and attachments before sending | Outlook, Outlook on the web, Exchange | |
| Browser uploads | Files and pasted text going to websites | Chrome, Edge, Firefox |
| AI prompts | Prompt text and uploaded files | Chrome, Edge, Firefox |
| Images | Text inside screenshots, photos and scans | Windows |
Questions.
Does content leave the device to be inspected?
No. Detection runs in the agent on the device. Only the decision and the evidence you choose to keep go to your Tracemark server, which runs in your own infrastructure.
What happens when a laptop is offline?
The agent enforces the last policy it received and stores events on disk. They are delivered when the device reconnects.
How do you keep false alarms down?
Weak detectors such as card numbers need corroboration from nearby keywords or structure before they count. Exact data match goes further and only triggers on your own records.
Can we start without blocking anything?
Yes. Run policies in audit mode to see what would have been blocked, then move channel by channel to warn, ask for a reason or block.
Does it use document labels?
Yes. Labels from Tracemark classification and Microsoft Purview are read, and a policy can treat restricted documents differently from internal ones.
Works well with
See it on your own data.
We walk through the channels and policies that matter to you, on a test machine of your choice.