Data Loss Prevention & Email Security

The page has two tabs, backed by two independent engines. Both are fully deterministic — pattern and heuristic matching only, with no AI/LLM involved, so they behave identically whether or not an AI provider is configured.

DLP Scanner

An on-demand utility that runs pasted content or an uploaded file through a set of regular-expression detectors for sensitive data (SSNs, credit-card numbers, AWS keys, generic API secrets, private keys, and JWTs). It is ephemeral — the scan runs in memory and nothing is written to the database. Every finding carries only a redacted preview of the match, never the raw value.

The same detector (scanForSensitiveData) is wired into several other surfaces automatically, so this tab is for one-off, ad-hoc checks:

• AI Copilot chat — a hit blocks the send entirely; the message never reaches conversation history or the external LLM, and the user gets a "Message blocked" reply.
• Malware-lab uploads and ticket comments — a hit raises a DLP alert (it does not block the action).

Inbound Mail Log

A read-only log of email received through a SendGrid Inbound Parse webhook. Each message is scored for phishing risk and given a verdict of clean, suspicious, or phishing. Only metadata is stored — never the email body or attachments.

Scan pasted text

1. Open Data Loss Prevention & Email Security and stay on the DLP Scanner tab.
2. Paste text, config, logs, or code into the box.
3. Click Scan Text.

Scan a file

Click Scan a File and pick a file. It is read as UTF-8 text and only the first ~1 MB (1,000,000 bytes) is scanned; anything beyond that is ignored.

Reading the results

Results appear in a table. A clean scan shows "No sensitive data detected". Each finding row has four columns:

The Inbound Mail Log tab lists the most recent received messages for your organization (newest first, up to 200), showing From, To, Subject, the SPF/DKIM/DMARC results, the verdict, and the received time.

Wiring up the webhook

1. Point a receiving domain or subdomain's MX records at SendGrid.
2. Configure SendGrid's Inbound Parse route to POST to /api/email-security/inbound?token=.
3. Set INBOUND_EMAIL_WEBHOOK_SECRET in the deployment's environment (see .env.example). If it is unset the webhook fails closed and returns 503; a missing or wrong token returns 401.

To scope scans to an organization, set that org's inboundEmailDomain to the receiving domain (the part after @ in the To address). Scans whose recipient domain matches are attributed to that org; unmatched mail is stored with no organization.

How the verdict is scored

SendGrid supplies a pre-computed SPF verdict directly; DKIM and DMARC verdicts are parsed from the Authentication-Results line in the raw MIME headers. Points are added deterministically:

The score is capped at 100. A score of 60 or more is phishing, 30–59 is suspicious, and below 30 is clean. Non-clean verdicts raise an alert at High severity for phishing and Medium for suspicious.

Detected data types

Scan endpoint

POST /api/dlp/scan is session-authenticated (call it from a signed-in session). Send either a JSON body with a text field, or multipart/form-data with a file field. It returns findings (the array shown above) and scannedLength (the number of characters scanned).

curl -X POST https://portal.guardfoxsecurity.com/api/dlp/scan \
  -H "Content-Type: application/json" \
  -d '{"text":"aws_secret AKIAIOSFODNN7EXAMPLE and ssn 123-45-6789"}'

Inbound mail endpoints

• GET /api/email-security/inbound — session-authenticated; returns up to 200 scans for your organization, newest first, each with its parsed flaggedReasons.
• POST /api/email-security/inbound?token= — the SendGrid Inbound Parse webhook target (token-authenticated, not session-authenticated). Reads the from, to, subject, SPF, and headers form fields and returns { ok, verdict, riskScore }.