Copy to removable media
A user moves sensitive data to USB through an authorized plaintext endpoint boundary.
DATA PROTECTION
Extend data policy to supported endpoint workflows without hiding platform limits.
Oten Data Protection connects Oten Protector policy to defined endpoint plaintext boundaries. Channel enforcement and persistent protection are separate control contracts: each requires an exact operating-system, application, release, offline, key, recovery, and evidence scope.
System role: Oten Endpoint DLP Agent + Oten Protector
Evaluation depends on: Requires platform-specific interception, Protector policy integration, key-service and recovery design where persistent protection is used, privacy review, and explicit offline behavior.
POLICYOten ProtectorClassify + Govern
CONTEXTDevice + ResourceAccess correlation
PEPEndpoint DLPPlatform-specific
DECISIONAllow · Warn · BlockUser-visible
Data leaves through legitimate user workflows, not only network exfiltration.
Paste into an AI prompt
Network-only inspection cannot consistently govern content already available to an approved local application.
Capture, print, or application export
Platform and application APIs create different enforcement boundaries and cannot be generalized as one channel.
A protected file leaves the organization
Revocation and offline behavior depend on whether the key travels with the file, whether the file is already open, and whether an approved export was created.
PROTECTION MODEL
Endpoint channel control and persistent protection solve different problems.
Channel controls can allow, warn, justify, block, or protect a supported user action. Persistent-protection architecture can keep a file encrypted outside a qualified device by separating ciphertext from conditional key release. Neither control is generalized beyond its verified platform and application boundary.
ACTION BOUNDARY
Endpoint DLP contract
A platform integration observes a defined action, evaluates approved policy and evidence, applies a supported result, explains it safely, and records the enforcement outcome.
KEY BOUNDARY
Persistent-protection contract
A protected container, authenticated key request, device and user qualification, offline grant, revoke behavior, and recovery workflow are evaluated as one system.
OWNERSHIP
Policy and endpoint enforcement have distinct owners.
Oten Protector
Owns data policy, classifiers and profiles, incident workflow, governance, and analytics.
Oten Endpoint DLP
Intercepts supported local actions, performs bounded inspection, enforces cached policy, and explains decisions to the user.
Access Control Plane
Provides qualified device and resource context, assignment, and cross-product audit correlation for the supported integration contract.
CONTROL CONTRACTS
Reduction, persistent protection, and approved export remain distinct.
A policy can combine these controls, but evidence for one cannot substitute for missing support in another.
RISK REDUCTION
Endpoint egress control
Removable media, clipboard, capture, print, share, upload, browser, email, and application controls vary by operating system and authorized plaintext boundary.
CONDITIONAL USE
Persistent protection
A protected file can remain ciphertext outside a qualified key-release path when the exact container, key, application, platform, offline, and recovery contract has been verified.
SANCTIONED EXIT
Approved export
An explicit workflow can create a new external copy with approval, recipient, expiry, watermark, sanitization, and audit requirements. That copy may not be recallable.
REVOCATION
Revocation is bounded by connectivity, key state, and the application session.
The support contract states what can be denied, when the decision is observed, which component enforces it, and what remains outside the control boundary.
Connected device requesting a key
A new key request follows the current qualified policy and key-service decision for the verified protection mode.
Offline device with a grant
Use can continue only within the signed offline scope and expiry defined for the exact release. Clock rollback cannot extend the grant.
File already open
Plaintext already held by an application is not assumed to close or disappear when a later key request would be denied.
Approved external copy
A separately exported copy can remain outside later revoke control, so approval, recipient, expiry, watermark, and audit govern the irreversible boundary.
Key or policy service failure
The mode defines whether a bounded offline grant, explicit denial, recovery path, or unavailable state applies. Failure cannot be shown as a successful protection result.
PLATFORM SCOPE
A shared policy model cannot create identical platform coverage.
The container and key-policy meaning can be shared, while the user experience and enforcement hook remain native to the operating system and application.
COMMON CONTRACT
Shared security meaning
Classification, policy version, container semantics, key purpose, device and user qualification, offline authority, audit, and recovery use a defined cross-platform contract.
PLATFORM CONTRACT
Native enforcement surface
Filesystem, clipboard, capture, print, removable-media, browser, application, and user-experience integrations are qualified separately for each operating system and release.
- Publish the supported operating system, version, architecture, application, and endpoint channel.
- Identify the observation point, enforcement action, reason code, acknowledgement, failure, and rollback path.
- Qualify performance and application compatibility under representative file size, concurrency, and offline conditions.
- Re-run qualification after operating-system, application, policy, key-service, or Oten component changes.
DECISION UX
Data controls should explain the decision without leaking content.
Allow
Avoid unnecessary friction; record only the evidence required by policy.
Warn
Name the safe data category, destination, and consequence, then require explicit acknowledgement.
Justify
Collect a structured business reason without sending sensitive content to analytics.
Block
Show a policy-safe reason and a legitimate remediation or exception path.
Protect
Explain the resulting file behavior, recipient or device condition, and recovery path.
SANCTIONED SHARING
Approved export makes an irreversible boundary explicit.
When policy permits an external copy, the workflow records why it is needed, who approves it, which recipient and expiry apply, what sanitization or watermarking occurs, and which evidence is retained.
Request
Name the recipient, business purpose, source classification, requested expiry, and accountable data owner.
Approve
Apply the required separation of duty, sanitization, watermark, recipient, delivery, and evidence conditions.
Deliver and record
Create the approved external copy through the verified delivery mode and record the export result without treating it as later recallable.
PRIVACY
Inspection is constrained by data minimization and governance.
- Minimize content sent off-device and separate operational telemetry from security evidence.
- Redact or mask evidence based on role; do not log clipboard or file content by default.
- Encrypt offline policy and verdict caches, bind them to version and TTL, and define deterministic conflict behavior.
- Provide user notification and complete legal, privacy, and employee-governance review for monitoring and recording.
Data-protection evidence is qualified per channel and protection mode.
- Operating system, version, architecture, application, endpoint channel, and required platform API.
- Oten Endpoint, Protector, Control Plane, and key-service versions that participate.
- Observation point, classifier or policy version, action, reason, acknowledgement, and user experience.
- Online, offline, stale, unreachable, partial, already-open, recovery, and approved-export behavior.
- Performance, compatibility, false-positive, exception, privacy, employee-notice, and support evidence.
- Accountable owner, reproducible test, known limitation, last verified date, and requalification trigger.
FAQ
Questions security and platform teams ask first.
Does endpoint DLP break end-to-end encryption?
No. An authorized endpoint integration can inspect a legitimate plaintext boundary before encryption or after decryption; it does not defeat or bypass the end-to-end cryptographic protocol.
Is the decryption key stored with the file?
The persistent-protection contract must state exactly whether key material is embedded, wrapped, cached, or requested and how it is bound to the file, user, device, policy, offline grant, and recovery path. Do not infer this from the marketing architecture alone.
Are all data channels supported on every operating system?
No. Clipboard, capture, file, removable-media, print, and application hooks vary by operating system and API. Each enforcement channel has an explicit platform and application support contract.
Does audit require storing user content?
Not by default. Audit should preserve the minimum policy, category, decision, source, destination, and enforcement evidence required for the use case, with role-based access and retention controls.
Next in Oten Access
Continue the technical evaluation.
Extend data policy to the endpoint without hiding platform limits.
Review the Agent boundary, the encryption and key-release model, and the security dependencies for data-in-use enforcement.