Appearance
Feature catalogue
Every row says whether the feature is available, conditional (it works only while a stated condition holds, which the endpoint or console reports), or not available. A feature is listed as available only when it is built and tested; the page that holds its limits is linked.
Detection
| Feature | Status | Notes |
|---|---|---|
| Built-in detectors: financial, contact and identity, credentials, organisational | Available | Detector catalogue. Each entry states its precision posture; none claims zero false positives. |
| Country packs: Azerbaijan, Turkiye, Russian identifiers, Gulf identifiers, procurement documents, geospatial | Available | Packs are versioned and locale-aware. |
| Classifications built from rules (OR) of typed elements (AND) | Available | A verdict is matched, not matched or not evaluated; a timeout or partial extraction never becomes a clean negative. |
| Exact Data Match | Available | Datasets imported in the console; keys rotated by the server. Exact Data Match |
| Document fingerprinting | Available | Operator-uploaded protected documents become shingle hashes. Fingerprinting |
| OCR | Conditional | Runs through a sandboxed helper only when the agent can isolate it. |
| Content extraction: OOXML, ODF, RTF, PDF, legacy Office compound files | Available | Byte, time and recursion limits apply. Extraction |
| Archive inspection | Available, limited | ZIP and deflate only. |
| Named-entity recognition, file-property and file-hash detectors | Not available | In the contract; nothing runs them. |
Policy
| Feature | Status | Notes |
|---|---|---|
| Scope by channel, operating system, destination, source path, application and Windows group; condition trees; exceptions; schedules | Available, with one gap | Policy model. Department scopes are accepted but match no endpoint yet. |
| Actions: audit, warn, justify, approval required, block, quarantine | Available, clamped | The applied action is the strongest the endpoint supports on that channel. |
| Signed policy bundles with anti-rollback | Available | Ed25519 signature; tenant, scope, expiry and version floor are checked. |
| Simulator | Available | Runs the same engine as the endpoint. |
| Connection policies | Available | Block named applications from connecting by address and port; content is not read. |
| Policy packs, templates and import | Available | In the console under Policies. |
Windows endpoint channels
| Channel | Observe | Warn | Block |
|---|---|---|---|
| File create, modify, rename, delete | Yes | Conditional | No |
| Removable storage | Yes | Conditional | No |
| Cloud-sync folders | Yes | Conditional | No |
| Archive creation | Yes | Conditional | No |
| Clipboard | Conditional | Conditional | No |
| Print (job metadata) | Conditional | No | No |
| Browser upload (managed extension) | Conditional | Conditional | Conditional |
| Outbound connections | No | No | Conditional (connections, not content) |
| Email attachment, Bluetooth, mobile-device transfer, optical burn | No | No | No |
"Conditional" is decided per endpoint at check-in, and the console shows that endpoint's answer. The authoritative table is the Capability matrix. Warning waits for a display receipt and is never recorded as shown without one.
Investigation and response
| Feature | Status | Notes |
|---|---|---|
| Incidents correlated by content, with repeat activity folded in | Available | Activity after resolution raises a new, related incident. |
| Explainable risk score (twelve weighted factors) | Available | Exceptions, enforced blocks and files removed soon after reduce or raise it, each reported beside the factors. |
| Activity explorer, user risk, behaviour analytics | Available | |
| Exception requests and approvals | Available | |
| Evidence access with required justification | Available | Every access is appended to the audit chain. |
| Sealed copy of the matched file in the tenant's own bucket | Available, opt-in | Owner opt-in per tenant and per policy. |
| Legal holds, retention windows | Available | |
| Reports: templates, schedules, destinations, exports | Available |
Discovery
| Feature | Status | Notes |
|---|---|---|
| Scan a mounted share | Available | Runs as a worker inside the API. |
| Scan an S3 bucket | Available | |
| Findings, remediation, scan history | Available |
Administration
| Feature | Status | Notes |
|---|---|---|
| Roles and custom roles, teams, user tags | Available | |
| Sign-in: local, OIDC, LDAPS directory | Available | |
| SCIM provisioning | Available | |
| API tokens and service accounts | Available | API |
| Append-only audit chain with export | Available | |
| Endpoint groups, assignment rules, update rollout | Available | |
| System health and component inventory | Available | Unconfigured components show as not configured, never healthy. |
Integrations
| Target | Status |
|---|---|
| Webhook | Available |
| Syslog (RFC 5424 or CEF) | Available |
| Splunk HEC | Available |
| Slack, Teams | Available |
| Jira, ServiceNow (escalation) | Available |
| E-mail and S3 as notification kinds | Not available; removed rather than built |
Capacity
One API process and one PostgreSQL on a contended 16-core host sustained 3,385 events/s (ingestion only) and 2,622 events/s when every event matched a policy, with zero errors. These are floors, not ratings. See Capacity for the method and what gives first.