CoverageWhat each surface .
This page states what every surface covers, one row at a time: what decides before data moves, what finds and reports it afterwards, and what runs on the device itself. How far each one is proven today is in Disclosures.
Surfaces
| Surface | Level | What it does |
|---|---|---|
| AI tools and assistants | Decides before data leaves | Checks what your applications send to an AI provider and what comes back, before either one moves. Every decision is recorded, and a request that cannot be recorded is refused rather than allowed through. |
| Outbound email | Decides before data leaves | Checks the whole message, including attachments, and decides before it is accepted for delivery. There is nothing to recall afterwards. |
| Microsoft 365 and Google Drive | Finds and reports | Reads what is already sitting in your drives and reports what it finds, naming the sensitive data without copying it. |
| AI agents and their tools | On the device | Approves or refuses each tool an AI agent tries to use, before it runs, and checks the result before the agent sees it. |
| Laptops and browsers | On the device | Covers the clipboard, sync folders and the AI tab a staff member opens. Every decision a device reports is rechecked centrally, and any that does not match your policy is rejected. |
Detection
- 106 kinds of sensitive data, each built from the issuer’s own published format. An automated test checks that number against the product, so this page stays current.
- Numbers are checked for validity, not just shape. A value that looks like an account number but fails the issuer’s own arithmetic is not reported.
- Exact-data matching against your own records, using a transformed copy, so the original values stay in your systems. If that copy fails to load, the system stops rather than quietly matching nothing.
- Built to catch data that has been disguised, not only data in its plain form. Disclosures states how far this is measured today.