Service · Cybersecurity

Data leak prevention (DLP)

Leaks in smaller firms seldom involve a criminal mastermind. Far more often, a salesperson with one foot out the door mails the client database to a private address, or an architecture studio in Kranj publishes a project folder via an open link and never revokes it, or a clinic employee copies appointment lists to a pen drive to catch up at the weekend. Intent is rarely bad. Nobody ever said where the edge was. DLP marks it. First comes an honest conversation about what would truly damage you in the wrong hands: tender prices, margin calculations, patient and personnel files, CAD drawings. Step two is teaching the system to recognise that material. Step three is configuring each way out, from outbound mail and cloud links to removable drives and private storage accounts. Usually the engine is already part of your Microsoft Purview or Google Workspace subscription. What has been missing is a set of rules calibrated so nobody's legitimate work grinds to a halt.

3 to 4 tiers
from open to strictly confidential
Four weeks
of silent observation before anything is stopped
Purview
or Google DLP, frequently already licensed
Warnings first
hard stops only where truly needed

Scope of the service

Rules that ignore real workflows fail. When people hit too many walls they find side doors, and side doors are invisible.

Check the scope with an engineer

Grading scheme

Very few tiers, plainly named and explained with examples from your own files, so deciding where a document belongs takes seconds, not a meeting.

Labels on documents

Purview labels tag a file, can encrypt it, and decide who may open it. Patterns such as EMŠO, a private individual's tax number or an IBAN can trigger a label automatically.

Mail guardrails

Confidential material addressed to webmail or an unrecognised domain triggers a pop-up warning or, if necessary, a hold. Overriding is possible with a typed reason, which is kept on file.

Cloud links

Anonymous links limited, guest access given an end date, periodic reports on what is shared with whom. Practices that swap drawings with clients get a dedicated, supervised exchange space.

USB and personal storage

Pen drives limited to reading or to encrypted models only, and confidential uploads to private cloud drives or browser chat tools held back.

Departures

Unusual bulk downloads or auto-forwarding rules in someone's final weeks show up. The response to such signals is settled beforehand with HR and legal counsel.

How the work runs

We introduce DLP in phases so that nobody discovers a broken process the hard way.

01

Workshop

Directors and team leads tell us what would do real damage if exposed, where it is stored and with whom it is routinely exchanged.

02

Silent running

Policies record but do not intervene. A few weeks later the data shows what goes out, through which channel, how frequently and what is normal business.

03

Gentle, then firm

Hints with a short explanation come first; blocks are kept for genuinely dangerous cases. Exceptions are agreed and written up.

04

Monthly care

A one-page summary of events and overrides, with rules refreshed when a new client, project or partner comes along.

Think of DLP as a line painted on the floor, not as suspicion. Most people have no idea they overstepped when a sensitive file left the building. A timely nudge corrects course without accusing anyone, while deliberate exfiltration stands out clearly. That equilibrium achieves more than turning every rule up to maximum.

Your questions answered

No. Policies match content patterns, such as an EMŠO or a confidential label, and no person browses messages. Which alerts go to whom is fixed in advance. Staff communication and the GDPR assessment of the set-up should be prepared with HR and counsel.

Business Premium covers the basics for Exchange, SharePoint and OneDrive along with sensitivity labels, while endpoint controls and automatic labelling require a bigger plan or an add-on. We demonstrate what your plan already does and only suggest more if it is genuinely warranted.

It should not be. Such exchanges move to time-limited links with a password, or a client-specific area. Catching such patterns before anything is enforced is exactly why the silent phase exists.

From the audit data that exists we reconstruct downloads, sharing and forwarding, then lock that evidence away. What happens next is a matter for your legal adviser. If logging was off, hindsight is limited, and that is the strongest argument for setting DLP up early.

Stop confidential files walking out of the door

Name the information you would least like to lose and your collaboration platform; we will explain what is achievable without buying more.

When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome

We set essential cookies only: the ones that keep the site running and recall which town you chose. Nothing for ads and nothing that follows you around the web. Details are in our privacy and data protection notice.