Glossary
The words this subject keeps using.
Written the way an admin would explain them to a colleague, not the way a standards document would.
- Browser DLP
- Data-loss prevention that runs inside the browser rather than on the network or in a mailbox. It is the only place that can see a paste into a tab, because that paste never crosses a network boundary anyone else is watching.
- Data exfiltration
- Data leaving the organization. In practice most of it is not an attack: it is somebody pasting into a chatbot, uploading an export to a converter site, or emailing themselves a file to work on at home.
- Shadow AI
- The AI tools a company's staff use without anybody approving them. The number is always higher than the admin expects, which is why the first week of measurement tends to be the useful one.
- Managed browser
- A Chrome browser enrolled in an organization's Google Admin, which lets an administrator apply policy to it. Policy, including force-installed extensions, only reaches browsers that are enrolled.
- Force install
- An installation policy in Google Admin that puts an extension into a browser and prevents the person using it from removing or disabling it. It is what turns an extension into an administrative control.
- Managed policy
- Chrome's mechanism for handing an extension its configuration from the administrator rather than asking the user. Capsulla uses it for exactly one value: the organization key.
- Organizational unit
- The tree Google Admin uses to group people and devices. Policy applies per organizational unit, which is how you pilot a rollout on one team before the whole company.
- Organization key
- The identifier that connects a browser to one company's console. Regenerating it disconnects every browser until the new key is deployed, which is also how you cut off a tenant you no longer control.
- Clipboard rule
- A pattern, a label and an action. The pattern says what to look for, the label is what you will recognise in the log, and the action is what happens when they meet: block, warn, mask or allow.
- Block
- The rule action that stops the content: it never reaches the clipboard or the page, and the person cannot click through it. The right answer for a secret, and the wrong one for anything you have not measured yet.
- Warn
- The rule action that shows a notification and lets the person continue. It changes behaviour without blocking work, which is why most rollouts start here and tighten later.
- Masking
- The rule action that replaces the matched part with its label and lets the rest through. A support agent can still ask about an order; the card number does not travel with the question. It is the action people route around least.
- Allow
- The rule action that changes nothing and only records the match. It sounds pointless until you need to know how often something happens before deciding whether to stop it.
- MIME type
- The type a browser reports for a file, such as application/x-msdownload for a Windows executable. File rules can match on it — and also on the file extension, because for plenty of files the browser reports no type at all.
- Whitelisted domain
- A hostname where no rule applies: nothing checked, nothing recorded. It is for the internal tools that are supposed to hold sensitive data, and it is what keeps a rollout from annoying the people living in them.
- On-device matching
- Running the rules in the browser, on the machine, instead of sending content somewhere to be classified. The practical consequence is that the sensitive text has nowhere else to exist — not in a vendor's queue, not in a log, not in a breach.
- Event metadata
- What a match leaves behind when the content itself is never sent: the rule, the action, the trigger, the site, the browser, the time, and for files the name, type and size.
- Retention window
- How long events are kept before they are deleted. Shorter is easier to defend and harder to investigate with; it is a choice each organization makes for itself.
- Controller and processor
- Under the GDPR, the controller decides why and how personal data is processed and the processor acts on its instructions. For data inside Capsulla, your organization is the controller and Capsulla is the processor.
Stop the next leak before it leaves the browser.
Try it free for 14 days, no card needed. Start with one team and see what Capsulla catches in the first week.