Data Protection Command Center —
Live per-organization posture — content scans, matches, enforcement verdicts and open incidents. Behaviour is driven by your org policy & settings.
Enforcement verdicts scans
Detection & Content Analysis M02
The shared detection engine every channel calls. Paste or type content to inspect it against the data-identifier library — real checksum validators (Luhn, Verhoeff, IBAN mod-97, GSTIN) cut false positives. Matched values are masked.
Scan content
Data-Identifier Catalog —
The generator-driven identifier library — India-first (Aadhaar, PAN, GSTIN, UPI, ABHA) plus global payment cards by network, IBAN per country, provider credentials/secrets, phones per country code, EU VAT, and national IDs — each validated where a checksum exists. Tune any identifier per-org (enable/disable, change its action) or add your own custom identifiers below.
Custom identifiers —
Define org-specific patterns (employee codes, project IDs, internal account formats). Stored per-org; catastrophic-regex and unknown-validator definitions are rejected server-side.
| Identifier | Regex-backed | Action | State | |
|---|---|---|---|---|
| No custom identifiers. | ||||
Identifiers per-org tunable
| Identifier | Category | Region | Validated | Action | Enabled |
|---|---|---|---|---|---|
| Loading… | |||||
Change an action or disable an identifier for this organization — overrides apply to every channel immediately.
Exact & Indexed Data Match M02 · EDM/IDM
Fingerprint your own records and documents so the engine detects them leaking — without ever storing the raw data. Exact Data Match keeps only a per-dataset salted hash of each field; Indexed Document Match keeps only shingle hashes. A provisioned dataset enforces its own action on every channel, regardless of the org default mode.
Exact Data Match — structured records —
Paste records one per line, fields comma-separated (e.g. Name,Email,Phone,Account). Only salted hashes are stored — the raw records are discarded immediately after indexing.
| # | Dataset | Records | Min fields | Action | Created | |
|---|---|---|---|---|---|---|
| No datasets indexed. | ||||||
Indexed Document Match — unstructured documents —
Paste a sensitive document; the engine fingerprints it into overlapping shingle hashes and detects partial copies or excerpts. The document text is discarded after fingerprinting.
| # | Document | Shingle k | Action | Created | |
|---|---|---|---|---|---|
| No documents fingerprinted. | |||||
Policy Management M12
Channel-agnostic policies — write once, enforce on endpoint, network, cloud, email and GenAI. Monitor policies audit only; enforce policies act. Conditions are evaluated server-side; every change is versioned.
Default posture
Policies —
| Policy | Channels | Identifiers | Mode | Action | Ver | State |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Select a policy to see its conditions and version history.
Incidents M14
Policy violations become incidents with derived severity, masked evidence (redacted by default) and a governed lifecycle. Select an incident to work it: transition state, assign, and read the timeline.
Incidents —
| # | Severity | Channel | Actor | Identifiers | Status | Opened |
|---|---|---|---|---|---|---|
| No incidents yet — detections that warrant action open incidents here. | ||||||
Insider Risk M11 · UEBA
Per-actor behavioural risk scored from DLP activity — block and warn rates, bulk egress, and channel spread. When an actor crosses the org escalation threshold, their next action is automatically raised one level (allow→warn→block). Scores update live as agents ingest content.
Highest-risk actors —
| Actor | Risk | Band | Events | Blocks | Bulk | Updated |
|---|---|---|---|---|---|---|
| No actor activity yet — risk accrues as agents ingest content. | ||||||
Data Security Posture M10 · DSPM
Register the data stores your organization holds — databases, buckets, shares, SaaS repositories — and Nexus scores each one's posture (0–100, higher is worse) from exposure, data sensitivity, open findings and encryption at rest, grading A–F. Prioritize remediation by the worst grades.
Register a data store
Registered stores —
| Store | Type | Exposure | Sensitivity | Findings | Encrypted | Posture | Grade | |
|---|---|---|---|---|---|---|---|---|
| No data stores registered. | ||||||||
SaaS Security (CASB) M07
Discover the SaaS apps in use, separate sanctioned from shadow IT, grade each app's posture (certs, MFA, encryption, data residency, breach history), and score the risk of third-party OAuth grants by the scopes they hold. Sanctioned and tolerated app lists are set in the Admin area; everything else is shadow IT.
Register / classify an app
Discovered apps —
| App | Status | Risk | Posture | Grade | Users | Last seen | |
|---|---|---|---|---|---|---|---|
| No apps discovered yet. | |||||||
Third-party OAuth grants —
| App | Actor | Scopes | Risk | Band | Granted |
|---|---|---|---|---|---|
| No OAuth grants recorded. | |||||
Agents & Channels M04/M06/M08
Endpoint, browser and email agents enroll here and authenticate with a short-lived service token. Each sends content through the same /v1/ingest engine and enforces the returned verdict locally.
Enroll an agent
Enrolled agents —
| Agent | Host | Platform | Version | Status | Last seen |
|---|---|---|---|---|---|
| Loading… | |||||
Compliance M16
How far your active enforcing policies cover each regulation's controls — India DPDP Act 2023, RBI/SEBI financial data, and PCI-DSS v4.0. Apply a pack to seed the recommended enforcing policies.
SIEM Export M17 · OCSF
Stream detection events to your SIEM or data lake as OCSF Data Security Finding (class 2006) over signed webhooks, or pull them on a schedule. Only ids and masked samples are emitted — never a raw value.
Add a webhook sink
Sinks —
| # | URL | Format | Enabled | |
|---|---|---|---|---|
| No sinks configured. | ||||
Recent events as OCSF preview
—
Admin Area —
Organization settings for —. Behaviour is data — these drive the detection engine and enforcement for this org. Secrets are encrypted at rest and never shown back.
Detection & response settings
Live connectors
Provision M365 email, incident notifications and other channels for this organization. Credentials are encrypted at rest; the browser only ever sees whether a secret is set.
Audit ledger —
Append-only and hash-chained — every sensitive action is recorded and the chain is cryptographically verifiable.
Super User Area platform
Platform-wide defaults and guardrails that cascade to every organization, plus the organization directory. These apply across all tenants unless an org overrides an admin-area setting.
Platform defaults & guardrails
Organizations —
| Tenant | Name | Kind | Status |
|---|---|---|---|
| Loading… | |||