You cannot protect data you have never found.
Tracemark finds sensitive files on laptops, file shares, cloud storage and databases, gives each one a level, and ranks the risk by who can open it.
One inventory, one set of levels.
Every module works from the same findings and the same four levels. The level set here is the level your DLP policies act on.
Data discovery
The agent scans laptops, servers and file shares. Connectors reach cloud storage, file sharing services and databases without an agent.
Classification
Patterns, keywords, context rules, registered documents and trained classifiers combine into one level per document. The strictest signal wins.
Labelling and marking
People pick a label in Word, Excel, PowerPoint and Outlook. A footer or a slide marking shows the level on the document itself.
Sensitivity labels
Your own ordered labels with sub-labels, mapped to the labels you already use in Microsoft Purview.
Data owners
Business owners see the sensitive files they own, review who can open them and ask for a fix.
Risk posture
One score for the estate, built from sensitivity, exposure, confidence and volume, with the riskiest files first.
Enforcement by level
Data Loss Prevention reads the level and decides what may leave by clipboard, USB, print, email, browser and AI prompt.
A label people see, and a level policy can trust.
The Office add-in reads the document as it is written and suggests a level. Authors can raise it. Choosing a lower level than the content supports asks for a reason, and the reason is recorded.
- Suggestions from content. The same detection engine as discovery, inside Word, Excel and PowerPoint.
- Mandatory labelling. Ask for a label before a document is saved, or before it is saved or printed.
- Visible markings. A footer on documents and spreadsheets, a marking on every slide, applied on save.
- Outlook on send. Classify mail before it leaves, tag the subject and stop restricted messages.
- Files and folders. Label a file or a whole folder from Explorer, or run bulk labelling from the command line.
Risk is sensitivity times exposure.
A restricted file five people can open is a different problem from one the whole company can read. Tracemark weighs every file by its level and its audience, then turns the estate into one score you can bring down.
- Weighted by audience. Anyone-with-the-link and whole-organisation access count far more than named people.
- Overexposed files listed. Restricted and confidential files open to everyone, ready to fix.
- Fix from the finding. Revoke broad access, approved by a second administrator.
- Honest gaps. Files the scanner could not read, and files whose access was never read, are shown apart and never counted as safe.
The people who own the data decide who keeps access.
Security teams rarely know whether a finance folder should be open to a whole department. The owner does. Owners get a simple page with their sensitive files and who can open them, and never the content.
- Three answers. This is fine, please fix, or not mine. Keeping access needs a reason and lasts until a set date.
- Security approves every fix. An owner's request goes to an approval queue. Nothing changes on its own.
- Fixed at the folder. On file servers, access is removed on the folder that grants it, so inheritance stays intact.
- Access reviews. Owners certify access by a due date. Unanswered entries are recorded as not certified.
A wrong label cannot hide sensitive data.
A document's level is the strictest of its signals. Only an administrator's review can lower it.
Strictest signal wins
An old Purview label, a keyword list or a path rule can raise a level. None of them can pull it below what the content shows.
Conflicts flagged
A label below the content is shown as a wrong label, so you can see where people under-classify.
Reviews expire with the file
When an administrator lowers a level and the file later changes, the review is released and the file is judged again.
False positives stay out
Findings marked as false positives never classify a document, and corrections teach the model to recognise similar files.
Discover, classify, protect.
One pipeline, from the first scan to a lower risk score.
Discover
Agents and connectors read files, shares, buckets and tables, including Office, PDF and archives.
Classify
Every signal is weighed and the strictest one sets the level.
Label
The level travels with the file as a label and a visible marking.
Protect
DLP enforces by level. Per-level rules can quarantine files found at rest.
Review
Owners review access, security approves the fix, and the score updates.
What is included.
Data Security Posture is a set of modules on one set of findings and one set of levels.
The agent scans local disks and file shares in the background. Findings close on their own when a file is cleaned or deleted, and reopen if the data comes back.
- Windows, macOS and Linux endpoints
- File shares from a scanner host
- Office, PDF, RTF, OpenDocument and legacy Office formats
- Archives opened and read file by file
- Password-protected files reported as encrypted
- Scan coverage shown per machine and per share
Each document gets one level from all its signals. People label in Office and Outlook, and administrators label files and whole folders in bulk.
- Word, Excel, PowerPoint, Visio, Project and Outlook
- Content suggestions as the author works
- Mandatory label on save, or on save and print
- A reason asked for when a level is lowered
- Footer and slide markings applied on save
- Explorer file and folder labelling, and a command line for bulk runs
Name your own labels on top of the four levels, such as Finance or HR, with one level of sub-labels. Each label carries the level DLP acts on.
- Ordered labels with sub-labels
- A sub-label always has its parent's level
- Purview labels read through Microsoft Graph, on a schedule or on demand
- Purview labels imported as Tracemark labels
- Purview labels read on files during discovery
- A pasted label export when Graph cannot be used
Teach Tracemark a kind of document, such as supplier contracts, board minutes or CVs, from examples of it and examples of what it is not.
- Trained from positive and negative examples
- Each classifier sets its own level
- Runs in connector scans, on Windows endpoints and at the mail gateway
- Example files discarded after training
Every sensitive file is matched to an owner: a named steward first, then the owner reported by the source. When nobody can be matched, the file is shown as unowned with the reason.
- A separate owner page with company single sign-on
- No access to the Tracemark console from it
- Digests of files that need a look
- Access reviews with a due date
- Fixes approved by the security team, never by the requester
- Removal of broad access on files and folders
A score out of 100 for the whole estate, a trend over time, and the sources and locations that carry the most risk.
- Risk per file from level, exposure, confidence and volume
- Sensitive files readable by everyone, listed
- Unread files and unmeasured access kept separate
- Revoke access from the finding, approved by a second administrator
Agentless discovery for data that never sits on a laptop. Connectors use the same detectors, context rules and remediation as the agent.
- SharePoint and OneDrive
- Amazon S3, Azure Blob and Google Cloud Storage
- Box, Dropbox and Google Drive
- PostgreSQL, MySQL and SQL Server
- Sharing read per file: links, guests and outside people
- Text in images read by server-side recognition
Move a sensitive file out of reach without deleting it. Files can be quarantined by hand, by a per-level rule after a scan, or when a document at a blocked level is saved.
- Files held, never deleted
- Restore to the original location on the agent's next sync
- Approval step before destructive actions
- Every attempt kept in the action's log
Register a sensitive document and any extract or edited version of it is caught. Register a table of records and documents that carry those records are caught too.
- Upload a document or paste its text
- Match when a set share of the document is present
- Structured records from a CSV, stored as fingerprints
- Used by discovery and by every DLP channel
Every built-in detector in one place, with how it works and an example. The same detectors run in every engine, so a finding means the same thing everywhere.
- Payment cards, bank accounts, secrets and keys
- National IDs grouped by country
- Accuracy measured from reviewed findings
- Copy a detector as your own keyword and pattern category
Where Tracemark looks.
| Source | How it is reached | What is read |
|---|---|---|
| Windows endpoints | Tracemark agent | Local files, Office and PDF content, archives, Purview labels |
| macOS and Linux endpoints | Tracemark agent | Local files |
| File shares | An agent on a scanner host | Files on the share and the folder permissions |
| SharePoint and OneDrive | Connector through Microsoft Graph | Files and how they are shared |
| Amazon S3, Azure Blob, Google Cloud Storage | Connector | Objects in the buckets and containers you choose |
| Box, Dropbox, Google Drive | Connector | Files in the folders you choose |
| PostgreSQL, MySQL, SQL Server | Connector | Table contents |
Questions.
Can a wrong label hide sensitive data?
No. A document's level is the strictest of its signals. A label below what the content shows is flagged as a conflict, and only an administrator's review can lower a level. That review is released when the file changes.
Do data owners see the contents of their files?
No. The owner page shows file names, levels and who can open each file. It uses its own sign-in and gives no access to the Tracemark console.
Does Tracemark change permissions on its own?
No. An owner's request and an administrator's revoke both wait for approval from the security team before the agent carries them out.
Does it work with Microsoft Purview labels?
Yes. Purview labels are read from Microsoft Graph, can be imported as Tracemark labels, and are read on files during discovery.
What happens to files the scanner cannot read?
They are listed apart with the reason, for example an image whose text recognition did not run. They are not counted in the score and are not treated as clean.
Works well with
See your own data map.
We run discovery on a test machine or share of your choice and walk through the findings, levels and risk score with you.