Data Loss Prevention

The DLP module detects and prevents sensitive-data leakage across three surfaces:

• Browser Extension — form fields, contenteditable elements, and file uploads on websites that match your policies.
• Outlook Add-in — email body and attachments scanned before send.
• Microsoft Teams — every channel message and chat message monitored server-side (requires an Azure AD app registration).

DLP requires an active subscription.

Getting started

1. Subscribe to the DLP module in Tenant Settings.
2. Open DLP → Groups and create a group, or import from a template.
3. Attach the group to one or more policies on the policy's DLP tab.
4. Communicate the change so users know what to expect on affected sites and messages.

DLP Groups

DLP patterns are organized into DLP Groups. A group contains one or more patterns and can be linked to any number of policies.

• Groups are created and edited under DLP → Groups.
• Groups link to policies through a many-to-many relationship. Scanning only activates on sites matched by a policy that has the group attached.
• A single policy can have multiple groups attached.
• Only enabled patterns from linked groups are pushed to the browser extension, the Outlook add-in, and the Teams monitor.

Templates

PolicyClue ships predefined DLP group templates. When creating a new DLP group, select Import from template to populate it with curated patterns.

Available templates:

• Financial Data — credit cards, IBAN/BIC, VAT numbers, payment references, CH/LI specifics.
• PII (EU/CH) — personal identifiers common in Switzerland and Europe.
• IT Information — network and IT identifiers, conservative to reduce false positives.
• Patient Data (CH/EU) — patient identifiers used in Swiss/European healthcare contexts.
• File Type Detection — detects and reports file types by extension and content signature. All 25 patterns ship as report-only; raise enforcement as needed.

Templates cover: executables and scripts, archives, macro-enabled Office documents, disk images, database files, certificates and keys, source code, configuration files, backups, healthcare data files, medical imaging, banking and finance files, accounting/tax files, and media (audio/video/image/PDF).

Scan targets

Each DLP pattern has a scan target that controls what the pattern is matched against. A single group can mix patterns of different scan targets.

Scan target	Matched against	Notes
Content (default)	Form-field text, email body, extracted text from files	The default; equivalent to classic text DLP.
Extension	The file extension of uploads or attachments	Regex-based (e.g. ^(exe|msi|bat|cmd)$). Simple filename-based restrictions.
MIME	The detected content type from the file's binary signature	More reliable than extension: a .txt file that is actually an executable is still detected as such.

Extension and MIME patterns run on the Browser Extension (file uploads) and the Outlook Add-in (email attachments).

Text scanning

Detects sensitive-data patterns in text content across all three clients.

• Browser Extension — patterns are regular expressions with Unicode support. Scanned elements include standard input and textarea fields as well as rich-text (contenteditable) editors. Scanning is event-driven — the extension checks content on focus-out, input, paste, submit, and Enter key events.
• Outlook Add-in — scans the email body when the user clicks Send.
• Microsoft Teams — scans every channel and chat message; HTML formatting is stripped before matching.

Duplicate alerts for the same pattern and matched value are automatically deduplicated within a session (page session in the browser, compose session in Outlook, per-message in Teams).

File scanning

The Browser Extension and Outlook Add-in scan file contents in real time before upload/send:

Format	Extensions	Extraction
PDF	.pdf	Text extraction, up to 5 pages / 200 KB
Microsoft Office	.docx, .xlsx, .pptx	Text extracted from Word body plus headers/footers, Excel shared strings, PowerPoint slides
OpenDocument	.odt, .ods, .odp	Text extracted from document body, styles, and metadata
Plain text	.txt, .md, .json, .xml, .csv, .log, .yaml, .yml	Direct UTF-8 reading
Unknown types	any	Sniff mode — reads the first 128 KB as text

Overall file scanning is capped at 10 MB per file.

Enforcement modes

Each pattern has an enforcement mode that decides what happens on a match. The same four modes apply across all three clients.

Mode	Browser Extension	Outlook Add-in	Microsoft Teams
Report	Log the detection silently — no user-visible action.	Alert logged silently — send allowed.	Alert created; message untouched.
Alert	Popup notifies the user — no masking.	Notification in the task pane — send allowed.	Alert created; message untouched.
Warn & Overridable	Mask the matched text with asterisks and show a popup with an Override option.	Show alert with override option — send blocked until user overrides.	Message content blocked (best-effort — see note).
Block	Mask the matched text with asterisks; no override, but user can submit an appeal.	Send blocked; user can submit an appeal but cannot proceed.	Message content blocked (best-effort — see note).

Teams enforcement caveat

Warn & Overridable and Block have identical effects in Teams: PolicyClue flags the message and Microsoft blocks access to its content. This requires the Communications DLP service plan (Microsoft 365 E5 or equivalent) plus the right Graph API permissions. If the tenant lacks the licensing, enforcement degrades to Alert only — the match is still logged as an alert but the message content is not blocked.

User overrides

When a pattern uses Warn & Overridable, users can override the detection and proceed after selecting a reason:

• False positive
• Business need
• Trusted destination
• Internal data
• Publicly available information
• Other

Once overridden, subsequent matches for the same pattern in the current session are silent. Each override generates an alert with the selected reason.

When a pattern uses Block, the detection is not overridable. Users can submit an appeal explaining why they believe the detection is incorrect. The appeal uses the same reason dropdown and generates an alert with the selected reason and justification.

Pattern exceptions

Each pattern can have one or more exceptions — string values that, if found inside a match, cause that match to be ignored.

Example: a credit-card pattern that should allow the test card 4111111111111111. Add the number as an exception; when the pattern matches it, the exception check sees the substring and skips the detection.

• Exceptions use substring matching (not regex).
• Exceptions are managed per pattern in the group editor.
• The same exceptions apply on Browser Extension, Outlook Add-in, and Microsoft Teams.

Common uses: known test data, legitimate values that match a broad pattern, reducing false positives without narrowing the regex.

Case-insensitive matching

Each pattern has an optional Case Insensitive toggle. When enabled, the pattern matches regardless of case. Applied consistently across the portal preview and all clients.

CSV import

Bulk-import patterns from a CSV directly in the group editor:

1. Open a DLP Group and click Import CSV.
2. Select your CSV file and configure the delimiter.
3. Choose the value column (and optionally a name column).
4. Set import options: case insensitive, word-boundary matching, enforcement mode, name prefix, enabled state.
5. Click Import — patterns are created one by one with a progress bar.

Values are automatically escaped into safe regex. Word-boundary matching wraps values with \b...\b so partial matches are avoided.

Regex validation

All patterns are validated before saving:

• Patterns must compile as valid regular expressions.
• Nested quantifiers (e.g. (a+)+, (a*)+) are rejected — they enable regex denial-of-service attacks that would freeze the user's browser.

Tips for writing patterns:

• Use \b word boundaries to reduce false positives.
• Use non-capturing groups (?:...) unless you need backreferences.
• Keep patterns as specific as possible — broad patterns generate noise.
• Use labeled patterns (e.g. requiring a keyword like IBAN: before the number) for generic number sequences.
• Test in the portal preview before enabling enforcement.

Alerts

DLP events generate alerts in the Alerts section. Each alert includes the DLP group and pattern name, the matched value, filename (for file-based detections), the policy, the URL domain (or teams.microsoft.com for Teams), user info, and the originating platform.

DLP alerts can be forwarded to external systems via Webhooks.