Skip to content
Docs

Data Loss Prevention

Detection categories (explicit, all on by default for relevant frameworks):

  • PII — SSN, driver’s license, passport number, full name (false-positive-tuned), email, phone, physical address, date of birth, IP address
  • Financial — credit card (PCI), bank account, IBAN, SWIFT, routing number
  • Health / PHI — medical record numbers, diagnoses (HIPAA framework)
  • Secrets — API keys (provider-prefix aware: sk-, pk-, AKIA, ghp_, xoxb-, etc.), passwords, JWT tokens, private keys

Detection engines: Presidio NER (spaCy en_core_web_sm/md/lg), custom regex, financial/health data, allow/deny lists, external webhook DLP (HMAC, retry), sandboxed JS plugins, domain rules.

Python bridge architecture: Presidio + spaCy run as a persistent Python sidecar (python-bridge/presidio_ner.py) that the main Node/Bun process talks to over JSON-stdin/stdout IPC. The sidecar carries an LRU result cache (configurable size + TTL — defaults: 1000 entries, 300s) so repeated detections of the same content are sub-millisecond. Tunable via env vars: SPACY_MODEL, NER_SCORE_THRESHOLD, NER_CACHE_SIZE, NER_CACHE_TTL. The sidecar is bundled into the production Docker image — no separate deploy needed. Actions: Risk scoring (0.0–1.0 numeric score per request — surfaced in the audit trail), Block (request is rejected before reaching the LLM), Redact (matched spans are replaced with [REDACTED] placeholders before forwarding), Log-only (detective mode for tuning new patterns), advanced NER. Inline at the gateway — prevention before the upstream provider sees the data, not after-the-fact trace scrubbing. MCP Proxy: DLP on tool call I/O — every tool invocation argument and response is scanned before forwarding. Custom recognizers: regex + NER-based patterns can be added per organization without code changes (e.g., proprietary part numbers, internal customer IDs, regional ID formats). Copyright + proprietary-code detection: webhook DLP plugins can be wired to any similarity-detection service (the platform doesn’t ship a built-in mirror-detection engine, but the integration surface is the same as for any external DLP). External webhooks receive request/response bodies with HMAC signing and can return block/redact/allow decisions. Config: Model selection (sm/md/lg), confidence threshold, cache, custom recognizers, severity overrides. fullName patterns were tuned to avoid false positives on factual queries (e.g., “what is the name of X”).