Protect sensitive data with DLP

Create a DLP model that detects secrets, financial data and personal data, then use it in a policy to block, warn or redact.

Data Protection stops sensitive content, like API keys, card numbers or national IDs, from reaching AI tools. It works in two parts:

A DLP model defines what counts as sensitive.
A Data Protection rule in a policy decides who the model applies to and what happens on a match.

You need a deployed DLP model before you can add the rule. Data Protection is only available on some plans. New to policies? Start with Policies overview.

Part 1: Create a DLP model

Go to Security → Data Protection and click Create DLP Model.
Enter a name and choose a template. You can change every rule afterwards.
- EU Personal Data: EU national ID numbers, contact details and health information.
- Secrets & Credentials: API keys, private keys, passwords, tokens and connection strings.
- Payments & Banking: card numbers, bank details, crypto wallets and unreleased financial results.
- Start from scratch: an empty model with no rules switched on.
Click Create Draft.

Built-in detectors

The Deterministic tab lists built-in detectors grouped by category: Secrets, Financial, Contact and network, and EU, US and Indian national IDs. They are exact, validated checks that run on the device, such as a card number that passes the Luhn check. Each one has a severity. Use the switch to turn it on or off.

Custom rules

Below the built-in detectors, click Add Custom Rule to match your own terms:

Keywords: words or phrases, one per line. Matching ignores case.
Regular expression: a pattern. Inline flags like (?i) work. Lookarounds and backreferences are not supported.

Give each rule a name and a severity: Low, Medium, High or Critical.

Dynamic rules

The Dynamic tab catches sensitive content that no pattern can describe. Click Add Dynamic Rule and describe it in plain language, as you would to a colleague. For example: "C++ code that contains or references our billing logic".

Each dynamic rule has a Sensitivity:

Strict: flags only clear matches. Fewest false alarms.
Balanced: recommended for most rules.
Relaxed: flags anything that might match. Catches more, with more false alarms.

Deploy the model

A new model is a draft and policies can't use it yet. Click Deploy in the draft banner, or in the options menu at the top right.

When you edit a deployed model, your changes are saved as a draft. Policies keep using the active version until you deploy the draft.

The Policies tab shows every policy that uses the model. You can't delete a model while a policy uses it.

Part 2: Add a Data Protection rule to a policy

Go to Security → Policies and open a policy, or click Create Policy.
Click Add rule and choose Data Protection.
Fill in the fields below and click Add rule.
Click Save, then Deploy.

Field	What it does
Model	A deployed DLP model. The rule always uses the model's active version.
Detection Rules	All rules, Selected rules, or Minimum severity (for example, High and above).
Enforcement	Block, Warn and redact, Warn or Watch.

Warn and redact prompts the user and always removes the flagged data before the request is sent.

There is one enforcement per rule. To treat some detectors differently, add a second Data Protection rule with a narrower match. If several rules match the same content, the strictest wins: Block, then Warn and redact, then Warn, then Watch.

Guard AI agents with Agent Guardrails: the same model-then-rule setup, for what AI agents do on a device.
Restrict file uploads: block whole file types instead of scanning their content.

Need help?

Contact support@getalesia.com.