Book a demo

Itzal Shield

Every other door out of the laptop

A file does not need an AI tool to leave. Shield checks the copy to a USB stick, the save into a sync folder and the upload to a personal account, using the same detection and the same policy as Guard.

Book a demo See pricing

  • 0new agents to deploy
  • 3actions per destination
  • 1policy behind them all

What you get

The leaks that leave no network record

These routes do not pass a gateway, so a gateway log cannot tell you they happened. Shield is on the device, where they do.

  1. 01

    A record of every file copied to a removable drive

    The drive's vendor and product id, a count and the file types. If there were findings, also the types, the counts and the masked file name.

  2. 02

    A check at the moment of the write, not a scan afterwards

    The file is read as it is being written and until the check finishes. Files already sitting on the drive are never touched.

  3. 03

    A different action per destination

    Allow and record, warn the person, or block the copy. USB can block while the sync folder only warns.

Where it works

The routes a file takes when nobody is looking

Each destination has its own switch and its own action, and each is off until an admin turns it on and gives a reason.

  • Sync folders

    Dropbox, OneDrive and Google Drive, the folder that quietly copies a laptop to somebody's personal cloud.

  • Removable drives

    USB sticks and external disks, checked as the file is written. Blocked if the check finishes in time; recorded either way.

  • Personal and cloud sites

    Personal email, file sharing, cloud storage and social sites on Itzal's list, plus every other website as a single switch.

Frameworks

Every framework brings its own thresholds and its own action

A finding is not just a kind of data, it is a kind of data under an obligation. Each framework carries its own thresholds and its own action, which is what lets one laptop block for HIPAA and only warn for Internal.

  • HIPAA

    Health records

    Patient names, record numbers and clinical detail, under the identifiers the rule lists.

  • PCI DSS

    Card data

    Card numbers validated by Luhn and BIN, so a test number next to the word example does not fire.

  • GDPR

    EU personal data

    Names, addresses, identifiers and the context that makes them a record rather than a mention.

  • CCPA

    California residents

    The same personal data, under the obligations that apply in California.

  • GLBA

    Customer financials

    Account and routing numbers, balances, and the material non-public information around them.

  • FERPA

    Education records

    Student records and anything that identifies a student inside them.

  • SOX

    Financial reporting

    Unreleased results, forecasts and the working papers behind them.

  • Internal

    Your own rules

    Your patterns and your own kinds of thing, in your words: project codename, claim handler, deal name.

Plans

How it is sold across the editions

Shield is included in the two platform editions and sold as an add-on on the Guard editions. It is the same agent either way, so adding it is a licence change rather than another rollout.

  • Guard Essentials Add-on

    Available on its own, priced per device like the edition.

  • Guard Pro Add-on

    Available on its own, priced per device like the edition.

  • Itzal Business Included

    Uploads anywhere, USB and sync folders, in the edition.

  • Itzal Enterprise Included

    As Itzal Business, with dedicated tenancy and longer retention.

See the full comparison and prices

What it catches

The file that left without passing a proxy

Three routes out of a laptop, none of which appear in a web gateway log.

  1. Leaving a job

    Someone copies a client folder onto a USB stick on their last Friday.

    The copy is checked as it is written. You get the drive's id, the file types, the finding counts and a masked file name, and the option to have stopped it.

  2. Working around a block

    An employee emails a contract to their personal Gmail to read at home.

    Personal email is a known site. The upload is checked before it goes, and what happens next is the framework's own action.

  3. Not thinking about it at all

    A finance file gets saved into a folder that happens to sync to a personal Dropbox.

    Shield sees the write, not the sync. The check happens on the device at the moment the file lands in the folder.

When it finds something

You choose what happens next

Three settings, chosen per compliance framework rather than per person, so HIPAA can block on the same laptop where Internal only warns. Most companies spend the first couple of months on the first one.

  1. Quietest

    Make a note of it

    Nobody is interrupted. You get a picture of what is happening before you change anything about how people work.

  2. In the middle

    Tell the person

    A banner before the send, saying what was spotted. They decide, and the decision is recorded.

  3. Firmest

    Stop it going

    Held until the data is taken out. Only where you have decided it is worth it, so the rule does not push people somewhere worse.

Set it to watch for a month, then decide. That is how almost everyone starts.

Book a demo How the rollout works

What Shield does not do

The limits, said plainly

Every product on this site has a boundary. Ours are worth knowing before you buy rather than after, and the console reports them the same way.

It does not scan files at rest.

Only the file being written, at the moment it is written. Not other files on the drive, not folder listings, not the contents of the volume.

It does not stop someone photographing the screen.

No software on the laptop can. Shield covers what goes through the machine, and a phone pointed at a monitor does not.

A block can still let a copy through.

If the check cannot finish in time the copy goes through and is recorded. We would rather record it honestly than hang the machine.

Questions

What people ask before they book

Short answers. The longer versions are in the pages linked from each one.

Is this a second agent to deploy?

No. Shield is the same agent Guard uses. If Guard is already on the laptop, turning Shield on is a licence change and a switch in the console.

Does it read files already on the USB drive?

No. Only the file being copied, as it is written. Other files on the drive, folder listings and the contents of the volume are never read.

What does the record contain for a clean copy?

The drive's vendor and product id, a count and the file types, and no file names. A copy with findings also carries the finding types, counts, a masked snippet and masked file names.

Do we have to tell staff before turning this on?

Yes, and the console makes you say so. Switching a destination on asks you to confirm staff were told and to give a reason; both go into the audit log with your name.

Can we watch a website that is not on your list?

Yes. “Every other website” is a single switch covering anything that is neither an AI tool nor a known personal site. Sites served over plain http are not covered.

The rest of the family

Everything else is a licence, not another rollout

If Guard is already on the laptop, Shield is a setting. Nothing new goes out to the fleet.

See Shield on your own laptops.

Shield is a licence, not a deployment. Half an hour, your hardware, and a straight answer on what it would cost.

Book a demo See pricing