airtable · egress
Airtable: Redact PII in Record Reads
Scans the responses of the Airtable record-read tools — the calls that return row fields values — and rewrites high-confidence PII shapes to a fixed…
Policies tagged "dlp"
asana · egress
Asana: Redact PII in Task & Comment Reads
On the Asana MCP read path, this transform scans the free-text business fields that ride back in task, comment/story, and status-update responses — notes,…
bigquery · egress
BigQuery: Redact PII in Query Results
Scans the content returned by BigQuery's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…
ms365 · ingress
Block Agent Email to External Recipients
Blocks agent-initiated Microsoft 365 email sends when any recipient address falls outside a corporate-domain allowlist.
confluence · ingress
Block Secrets in Confluence Pages and Comments
Blocks Confluence write calls whose body looks like it contains a live credential — an API key, password, token, or PEM-formatted private key — before the…
slack · ingress
Block Secrets in Slack Messages
Blocks Slack send-message tool calls whose message body looks like it contains a secret — API keys, passwords, tokens, or PEM-formatted private keys.
zoom · ingress
Block Secrets in Zoom Team Chat
Blocks Zoom Team Chat send/update tool calls whose message content looks like it contains a live secret — API keys, passwords, bearer tokens, or…
intercom · ingress
Cap Intercom Contact Enumeration
caller is a CRM admin); clamp page size on everything else; allow the rest
intercomcap-bulk-exportcontact-enumerationdlpingresssoc2hipaapci-dssgdpr-ccpa
quickbooks · ingress
Cap QuickBooks Bulk Search Exports
Clamps the bulk-read levers on every QuickBooks Online search tool so an agent cannot pull the entire general ledger — or a full customer, vendor, or…
quickbookscap-bulk-exportbulk-exportdlpingresssoc2pci-dssgdpr-ccpa
confluence · egress
Confluence: Redact PII from Page & Comment Responses
Scans the responses of Confluence page, comment, and search read tools and rewrites personally identifiable information to fixed redaction tokens before the…
confluenceatlassianredact-piipiidlpredactionegresssoc2hipaagdpr-ccpa
databricks · egress
Databricks: Mask Cardholder PANs in Responses
Masks payment-card numbers (PANs) in Databricks tool responses before the agent receives them.
databricksmask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
databricks · egress
Databricks: Redact PII in Tool Responses
Scans the response payloads of the Databricks MCP tools that carry lakehouse data back to the agent and rewrites personally identifiable information to fixed…
onboarding · ingress
Deny Email PII
This policy stops a request if it contains an email address. If there's no email address, the request goes through as normal.
docusign · egress
Docusign: Redact SSN, Bank & Card Values on Egress
Scans the responses of Docusign envelope- and agreement-reading tools and rewrites high-confidence regulated identifiers before the response reaches the…
docusignredact-piitab-valuespiiphipandlpredactionegresssoc2gdpr-ccpa
dropbox · egress
Dropbox: Redact PII, PANs, and Secrets in File Content
Scans the responses of the Dropbox file-content read tools and sanitises the returned text before it reaches the agent.
dropboxredact-contentredact-piimask-pansecretspiidlpegresssoc2hipaagdpr-ccpa
github · egress
GitHub: Redact Secrets from Read Responses
Scans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…
glean · egress
Glean: Redact PII from Read-Tool Responses
Scans the responses of Glean's content-returning read tools and rewrites high-confidence PII to fixed redaction tokens before the response reaches the…
google-drive · egress
Google Drive: Redact PII from File Content
Scans the responses of the content-returning Google Drive tools — file reads, downloads, and Docs/Sheets/Slides content fetches — and rewrites personally…
google-driveredact-piipiidlpredactionegresssoc2hipaagdpr-ccpa
gusto · egress
Gusto: Redact Financial IDs in Responses
Instantiates PF-02 (redact-pii-egress) on the Gusto read path.
gustoredact-pii-egressredact-piipiifinancial-piidlpredactionegresssoc2gdpr-ccpa
intercom · egress
Intercom: Mask Card Numbers in Conversation Responses
Masks payment-card numbers (PANs) in Intercom conversation content returned to agents by the conversation- and free-text-returning read tools.
intercommask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
intercom · egress
Intercom: Redact PII from Conversation & Contact Reads
Scans the free-text returned by Intercom's conversation- and contact-read MCP tools and rewrites high-confidence personal identifiers and credential shapes…
linear · egress
Linear: Redact Customer Revenue and Contacts
Masks commercial and contact identifiers in the responses of Linear's Customers read tools before they reach the agent.
gmail · egress
Mask Card Numbers in Email Content Read by Agents
Masks payment-card-number (PAN) shapes in email content returned to agents by Gmail mailbox-read tools.
gmailmask-pan-egressegressemailcardholder-datadlpsoc2pci-dssgdpr-ccpa
ms365 · egress
Microsoft 365: Redact PII from Mail, Files & Transcripts
Scans the responses of the highest-density PII read surfaces in Microsoft 365 — mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and…
monday · egress
monday: Redact PII in Board & Doc Reads
Two egress controls in one policy, both scoped to the monday MCP read path:
netsuite · egress
NetSuite: Redact Financial PII in Responses
Instantiates PF-02 (redact-pii-egress) on the NetSuite read path.
netsuiteredact-piipiifinancial-piidlpredactionegressgdpr-ccpasoc2
notion · egress
Notion: Redact PII from Read Responses
Scans the responses of the Notion hosted MCP server's content-returning read tools and rewrites personally identifiable information to fixed redaction tokens…
power-bi · egress
Power BI: Redact PII in Query Results
Scans the content returned by Power BI's result-returning tools and rewrites high-confidence PII shapes to fixed, non-recoverable redaction tokens before the…
quickbooks · egress
QuickBooks: Redact Employee & Vendor PII on Read
On the read path, this policy masks sensitive identifiers in the responses of four QuickBooks Online (QBO) name-entity read tools — get employee, search…
google-calendar · egress
Redact Attendee PII and Meeting Links in Calendar Reads
Scrubs sensitive fields from the responses of Google Calendar read tools before they reach the agent, for callers who lack the placeholder calendar-full-read…
google-calendarredact-piipiiphidlpredactionegresssoc2hipaagdpr-ccpa
onboarding · egress
Redact Email PII
This policy automatically masks email addresses in what a tool sends back, replacing each one with [REDACTED] before your agent ever sees it.
salesforce · ingress
Salesforce Cap Bulk Data Export
Blocks bulk PII extraction through Salesforce query tools by inspecting the free-text query arguments that are the real policy surface for these servers.
salesforcecap-bulk-exportdata-minimizationdlpingresssoc2hipaapci-dssgdpr-ccpa
salesforce · egress
Salesforce Redact PII
Redacts personal contact information from Salesforce tool responses before they reach the caller.
salesforcepiidlpredactionegresssoc2hipaagdpr-ccpaiso27001-nist
slack · egress
Slack: Mask Card Numbers in Message and Search Responses
Masks payment-card numbers (PANs) in Slack content returned to agents by message-read, thread-read, canvas-read, history, and search tools.
slackmask-pan-egressegresscardholder-datadlppci-dsssoc2gdpr-ccpa
snowflake · egress
Snowflake: Redact PII from Query Result Sets
Scans the row content returned by the result-returning Snowflake MCP tools and rewrites personally identifiable information to fixed redaction tokens before…
stripe · egress
Stripe: Redact Customer PII from Bulk Reads
Masks customer PII in the responses of Stripe's bulk PII egress channels before they reach the agent.
tableau · egress
Tableau: Redact PII & Mask PANs in Query Results
Tableau is a warehouse proxy: the data-returning tools stream raw row-level content out of whatever the published datasource connects to — PII, PHI, payroll,…
tableauredact-pii-egresspiipandlpredactionegresssoc2gdpr-ccpa
zapier · egress
Zapier: Mask Card Numbers in Read Responses
Masks payment-card numbers (PANs) in Zapier MCP read responses before they reach the agent.
zapiermask-pan-egressegresscardholder-datadlpsoc2pci-dssgdpr-ccpa
zoom · egress
Zoom: Redact PII in Meeting Intelligence
Scans the responses of Zoom's meeting-intelligence read surfaces — AI summaries, verbatim transcripts, recording resources, and Zoom Docs content — and…