Cloud DLP Boundary Simulator

Outbound file

Destination cloud app

Outbound DLP scanner

Exfiltration tally

Sensitive data leaked — DLP OFF

Sensitive data leaked — DLP ON

Uploads attempted

Blocked by DLP

How the boundary scan works

Every attempt is graded twice, once per world: with no DLP every upload leaves unmonitored, so any sensitive file reaching an unsanctioned app counts as exfiltrated. With DLP on, a scanner at the boundary pattern-matches the file's content against sensitive-data signatures (card numbers, national IDs, confidential markers) before it crosses.

Sanctioned destination → allowed regardless of content — it's expected, authorized business use.
Unsanctioned destination + no sensitive match → allowed, nothing regulated is at risk.
Unsanctioned destination + sensitive match → blocked/redacted at the boundary, the transfer never completes.

The DLP ON/OFF toggle drives the live boundary animation; the tally above always scores both worlds on every attempt so you can see the gap widen.

Org boundary Sanctioned app Unsanctioned app Sensitive content flagged

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.