> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data loss prevention

> Detect and mask PII and secrets in AI traffic on input and output. Configure data categories and custom rules in the console — the only transform-capable detector.

The **Data Loss Prevention** detector finds sensitive data — PII and secrets — in
prompts and model output, and can **mask it in flight**. Create and configure it in
the console under **Detectors**; attach it from a [policy](/trustguard/concepts/policies)
to choose what happens when it matches.

It is the only **mutable** detector: the only one that supports the **Transform**
action (mask matched values before the payload continues).

| Property     | Value                |
| ------------ | -------------------- |
| Catalog type | Data Loss Prevention |
| Sides        | Input, Output        |
| Protocols    | All                  |
| Mutable      | ✅                    |

JSON bodies are masked **structurally** (string values only — keys are never
touched); plain-text bodies are masked directly. Matches that are secrets (API
keys, access tokens, JWTs, Stripe keys) are reported as secret findings; other
entities as PII.

## Configure in the console

1. Open **Detectors** → create a detector and pick **Data Loss Prevention**.
2. Under **Data Categories**, choose what to detect (or use **Enable all**).
3. Optionally add **Custom rules** for keywords or regex patterns that are not in
   the built-in catalog.
4. Save the detector, then add it to a [policy](/trustguard/concepts/policies) rule
   (Input and/or Output) with an action.

You must configure at least one of: **Enable all**, one or more data categories, or
one or more custom rules.

## Actions (on the policy)

The detector only finds and (when Transform is selected) masks. The action is set
on the policy rule that references it:

| Console label | Effect                                                                 |
| ------------- | ---------------------------------------------------------------------- |
| **Monitor**   | Record a finding; leave the payload unchanged.                         |
| **Block**     | Record a finding and flag the request to be blocked.                   |
| **Transform** | Record a finding and forward a masked payload. Only DLP supports this. |

## Data Categories

The form groups **43** built-in entities into searchable categories. Toggle
individual entities on or off, or use the **Enable all** control to mask every
catalog entity at once.

| Group                         | Examples                                                          |
| ----------------------------- | ----------------------------------------------------------------- |
| **Personal information**      | Email, phone, passport, driver's license, VIN                     |
| **Financial data**            | Credit card, CVV, IBAN, bank account, crypto wallet               |
| **Secrets & credentials**     | API key, access token, JWT, Stripe key, UUID                      |
| **Device & network**          | IP / IPv6, MAC, IMEI                                              |
| **National & government IDs** | SSN, tax IDs, and national ID formats (ES, FR, IT, DE, BR, MX, …) |

**Secrets** — these four are reported as secret findings (the rest as PII): API
key, access token, JWT token, Stripe key. (UUID appears in the Secrets group in
the console for convenience; it is not classified as a secret finding.)

When Transform runs, predefined entities are replaced with an entity-specific
token (for example `[MASKED_EMAIL]`) unless you rely only on custom rules.

## Custom rules

Use **Custom rules** when you need patterns that are not in the built-in catalog
— internal account IDs, project codes, product-specific tokens, and so on.

1. In the detector form, open **Custom rules**.
2. Click **Add custom rule**.
3. Set **Type**:
   * **Keyword** — exact substring match (e.g. `confidential`).
   * **Regex** — a regular-expression pattern (e.g. `ACME-\d{6}`).
4. Enter the keyword or pattern (required).
5. Optionally set **Mask with** (default `***`) and **Preserve length** (replace
   with `*` repeated to the original length).
6. Add more rules as needed; each rule is evaluated in order along with the
   selected data categories.

Empty patterns are invalid — the console blocks save until every custom rule has
a non-empty keyword or regex.

## When to use

* **Output + Transform** — strip PII the model regurgitates before it reaches the
  user.
* **Input + Transform** — keep PII out of third-party model providers.
* **Block** on secret categories (API key, access token, JWT, Stripe key) — stop
  credential leakage.
* Start with **Monitor** (and policy **Report** mode) when enabling broad
  categories, then switch to **Enforce** + Block/Transform once the signal looks
  right.