New · Release 2026.04, Multi-tenant audit exports & SLA dashboards now live See changelog →
InfronestCentralize Your IT World
Data protection

Data loss prevention that closes USB, print and browser-upload leaks

Block USB storage and printing where you need to, check uploads to personal accounts for Aadhaar, PAN and card numbers, and review every incident with a redacted sample — on the computers Infronest MDM already manages.

Product preview · sample workspace (demo data)
Engagements
RBAC
Tickets
acme.infronest.com/workspace
All systems operational
WORKSPACE
A
Acme Corp
MODULES
Overview
Infrastructure
Security & VAPT
IT Assets
Tickets23
Git & QA
Vendors
Budgets
Access & RBAC
Live workspace overview
Last sync 2s ago · Updated by agent
Today7d30d
Servers
142
All healthy
Open tickets
23 (7 urgent)
SLA at risk
Assets tracked
1,284
+12 this week
VAPT score
A+
Last scan 2h ago
Server response time · last 24h
avg 142ms
Product proof

Already live in the product

Backed by app modules

Live in the product today: the Data Protection dashboard, policies, incidents and reports, plus the discovery, cloud, email and insider-risk pages that Advanced DLP unlocks.

Protected app route: /dlp
How it works

Built around real workflows

Highlights below describe capabilities already present in the protected app behind this page.

USB storage control: read-only, blocked or ejected, by OS
Print blocking and a print activity log
Browser upload and paste checks in Chrome and Edge
Aadhaar, PAN, card, SSN, email and phone detectors
Personal webmail and consumer cloud-storage site blocking
Screen watermark with user, device and time
Incidents with redacted samples, exported as CSV, XLSX or PDF
Advanced DLP: file scans, custom detectors, USB-copy alerts and insider-risk scores
Workflow

What teams can do here

Step 1
Confirm the devices are enrolled in Infronest MDM
Step 2
Create a DLP policy and choose the channels to control
Step 3
Push the policy to all or selected devices
Step 4
Review incidents with redacted matches
Step 5
Tune allow-lists and export reports
How it works

How it works

01
Start from devices you already manage
DLP runs inside the Infronest MDM agent on Windows, macOS and Linux, so there is no second agent to roll out. Once DLP is switched on for your organisation, a Data Protection section appears for your admins.
02
Decide what each channel may do
A DLP policy sets the controls: USB storage, printing, uploads and pastes into personal accounts in the browser, personal webmail and consumer cloud-storage sites, the screen watermark and screenshot deterrence. Detectors for Aadhaar, PAN, card numbers, SSN, email and phone decide what counts as sensitive, and the action (block, warn or monitor) decides what happens next.
03
Push it to the right devices
Send the policy to every enrolled device or only to the ones you pick, such as the finance team’s laptops. Devices that are online apply it within seconds, and offline devices pick it up when they reconnect.
04
Catch the risky upload on the device
When someone uploads or pastes into a personal destination, the agent checks the content locally. A high-risk match is blocked if the policy says block, and a medium-risk one gets a warning. Either way an incident is raised with a redacted sample, and the raw value never leaves the device.
05
Review, allow and report
Each incident shows the device, channel, data type and action taken. A legitimate company domain can be allowed in one click, and incident and print-activity reports export for your audit file.
Example

A worked example

Take a 200-person NBFC whose loan files carry Aadhaar and PAN numbers. Its IT team already runs Infronest MDM on every laptop, so it switches on DLP Basic, makes USB storage read-only across the Windows fleet, turns printing off for the collections team and sets browser uploads to personal accounts to block. In the first week the incident list shows one block, when an analyst tried to upload a CSV of customer records to a personal Gmail account, and two warnings for phone numbers pasted into a personal cloud drive. Each incident carries a redacted sample, never the customer data itself. At quarter end the auditor asks for evidence, and IT exports the incident and print-activity reports as a PDF.

In depth

DLP Basic and Advanced DLP: what each tier adds

DLP Basic (₹79 per user per month) covers the everyday exits: USB storage control, print blocking with a print activity log, browser upload and paste checks for personal accounts, blocking of personal-webmail and consumer cloud-storage sites, the screen watermark and screenshot deterrence. It also gives you the incidents console and reports. Its detectors look for Aadhaar, PAN, payment-card, SSN, email and phone patterns.

Advanced DLP (₹129 per user per month on top of DLP Basic) looks for sensitive data at rest and watches how it moves. It scans monitored folders and Downloads for text-based files, runs an on-demand full-disk scan and adds custom regex, keyword-dictionary, health-record and Indian postal-address detectors. It also alerts when a sensitive file is copied to USB, lets users justify an override, keeps an encrypted evidence copy of quarantined files and scores insider risk. Its Data Discovery, Cloud & Web, Email DLP and Insider Risk pages appear only once it is on.

A few Advanced DLP connectors need setup on your side before they do anything. Your Microsoft 365 admin deploys the Outlook add-in for on-send email checks. Google Drive and OneDrive or SharePoint scanning needs those accounts connected under Integrations, and database and network-share discovery need read-only credentials.

In depth

Channels covered on Windows, macOS and Linux

Each control is described below as it behaves today, including where it stops, so the policy you write matches what the device will actually do.

  • USB storage: read-only on Windows, blocked on Linux and ejected after mounting on macOS. It is an on/off control, not a content check. Advanced DLP adds an alert when a file it has flagged as sensitive is copied to a USB drive.
  • Printing: switched off entirely when blocked, on all three operating systems. With the print log on, each job is recorded with the user, printer, document name and page count.
  • Browser uploads and pastes: Chrome, Edge and other Chromium browsers on Windows and Linux. Company accounts are allowed and personal destinations are checked, and an allow-list-only mode can limit uploads to approved sites.
  • Personal webmail and consumer cloud storage: a fixed list of popular services is blocked at site level on Windows, macOS and Linux. Google Drive and Docs stay reachable on purpose, because blocking them breaks everyday work. Uploads to a personal Google account go through the browser checks instead.
  • Screen: a watermark showing the user, device and time on Windows, macOS and Linux. Screenshot attempts are discouraged and logged, which deters leaks but is not a hard block.
  • Phones and tablets: not covered. DLP does nothing on Android or iOS.
In depth

How detection works, and how to tune it

Checks on the device are pattern-based, which keeps them fast and local. That also means they are not checksum-validated, so a twelve-digit number that is not a real Aadhaar can still raise an incident. Expect to tune in the first weeks: allow your company domains, start new policies on warn, and move to block once the incidents look right. Medium-risk types such as email and phone warn rather than block.

Advanced DLP adds custom regex, keyword dictionaries with a match threshold, health-record patterns and Indian postal-address detection, for data that only your organisation can describe. The on-demand full-disk scan applies a Luhn check to card numbers. The server-side scans behind the email, database and network-share connectors validate Aadhaar, card and GSTIN numbers with their checksums, and also recognise IFSC codes, passports, voter IDs and driving licences.

In depth

What you need before switching DLP on

DLP needs Infronest MDM on every endpoint it protects: MDM Enterprise is ₹850 per endpoint per month, minimum 50 endpoints. DLP Basic is then ₹79 per user per month, and Advanced DLP is a further ₹129 per user per month for the users who need it.

If you also want endpoint detection, two bundles are cheaper than buying the parts. The Security Starter Bundle (₹299 per user per month) combines DLP Basic with EDR and Device Activity. The Full Protection Bundle (₹599 per user per month) combines both DLP tiers with EDR, SIEM and phishing simulation. Both are listed under bundles on the pricing page.

FAQ

Frequently asked questions

How much does DLP cost?
DLP Basic is ₹79 per user per month. Advanced DLP costs ₹129 per user per month and is added on top of DLP Basic. Both run on endpoints managed by MDM Enterprise (₹850 per endpoint per month, minimum 50 endpoints). The Full Protection Bundle includes both DLP tiers with EDR, SIEM and phishing simulation. See DLP pricing and the bundles.
Do I need Infronest MDM to use DLP?
Yes. DLP is enforced by the Infronest MDM agent, so a device has to be enrolled in MDM first, and the DLP module can only be switched on for an organisation that has MDM. The upside is that there is no separate DLP agent to install, update or keep alive.
Which browsers does browser upload protection support?
Google Chrome and Microsoft Edge, plus Brave, Vivaldi and Chromium, on Windows and Linux. The agent installs the Infronest extension through browser policy, and Chrome only accepts an extension from outside its store that way on enterprise-managed machines, such as domain-joined Windows PCs, so we check browser coverage on your fleet during rollout. Firefox and Safari are not supported.
Does sensitive data leave the device when an incident is raised?
Not for endpoint and browser checks. The match is worked out on the device, and the incident carries a redacted sample with the data type, channel and destination. The raw Aadhaar or card number stays where it was found. Advanced DLP’s optional email, cloud-drive and database scans work on our servers by design, and they are only active once you connect those systems.
Can an employee override a warning?
With Advanced DLP you can let users continue past a warning by typing a business reason. The override and the reason are saved with the incident, so a reviewer can see who decided what and why without chasing anyone.
Does DLP block screenshots and the clipboard?
Screenshots are discouraged, not blocked. The agent closes known capture tools, removes freshly saved screenshots and records an incident, and the screen watermark makes leaked images traceable. A hard block needs a locked-down device. Clipboard copying is not blocked or scanned today.
Does DLP work on Android or iPhone?
No. DLP protects Windows, macOS and Linux computers running the Infronest MDM agent. Restrictions on phones and tablets, such as blocking screen capture, belong to the device-management policies for those platforms.
How does DLP help with DPDP obligations?
The platform is DPDP Act 2023 aligned. DLP adds controls and records you can show for personal data such as Aadhaar and PAN numbers: blocked uploads, incident history with redacted evidence, print logs and exportable reports. It is tooling that supports your own obligations, not a certification.

See also: MDM software · Endpoint detection & response · DPDP compliance operations · Device activity monitoring · DLP pricing

Related

Explore connected offerings

Close the exits sensitive data actually uses

USB, print and browser-upload controls on the devices you already manage, with redacted incidents your auditors can read. See it on a test laptop in a walkthrough.