The threat
Engineering work is paste-shaped.
Every path below is an engineer or a buyer moving faster, and none of it is personal data. That is precisely why a DLP programme built around PII detectors reports almost nothing here and is mistaken for coverage.
-
Explaining a failure mode
The specification is pasted so the question makes sense.
Trips Internal
-
Drafting an RFQ or comparing quotes
Supplier pricing goes in whole, because the comparison is the point.
Trips Internal
-
Rewriting a work instruction
The instruction is improved by pasting the instruction, and it contains the process.
Trips Internal
-
Summarising a customer drawing
A drawing arrives as an attachment and is dropped in without being read first.
Trips Internal / NDA
None of this is covered by a built-in detector, and claiming otherwise would be the failure this product exists to avoid. It is covered by custom rules — a part-number format or a classification header as a pattern rule, which can block; a described entity type, which reports.
How the detection layers workWhat’s specific here
The data has no regulator, and no pattern.
Manufacturing is the clearest case of a gap that general-purpose DLP hides: the detectors all fire on personal data, and almost nothing here is personal data.
-
01
A PII detector will report nothing
A tolerance table contains no names, no card numbers and no health terms. A console showing zero findings on a fleet of engineering laptops is not evidence of safety; it is evidence that nothing was looking.
-
02
Formats are what make rules possible
Part numbers, drawing references and classification headers are structured. A regular expression over them runs in the agent, inside the deadline, and can stop a send rather than record one.
-
03
Attachments are the real volume
Nobody retypes a spec. It is dropped in, which is why reading DOCX, XLSX, PPTX and PDF on the device matters more here than typed-text detection does.
-
04
Speaker notes carry the working detail
A deck is read slide by slide including its speaker notes, which is where the numbers a presenter did not want on screen tend to live.
What it does here
Someone pastes a specification. Itzal stops it.
Engineers route around controls that slow them down, and a policy nobody follows is worse than a control that works. Itzal sits on the laptop and checks the text in the instant before it is sent.
A part number is a format you define, so it is a pattern rule and it can block. Your team gets a record saying which rule fired; the text itself never goes anywhere.
Illustration. The data shown is invented.
Rollout
The pilot measures your formats, not our detectors.
A log-only window on a PII-shaped policy will report almost nothing here, and that silence is easy to mistake for safety. The pilot has to run on rules written against your own part and drawing numbering.
-
00
Write rules for your numbering
Part numbers, drawing references and classification headers are formats, so they are pattern rules — which run in the agent, inside the deadline, and can stop a send.
-
01
Log-only, one engineering team
Nothing is blocked. The measurement is whether the part-number pattern fires on parts and not on order references, purchase requisitions or dates.
-
02
Tune, and add the attachment path
Most of the volume is dropped files rather than typed text, so the tuning pass has to include what the readers pull out of DOCX, XLSX, PPTX and PDF.
-
03
Warn
Engineers route around anything that slows them down. A high dismissal rate is a signal the pattern is too broad, not a reason to make the warning louder.
-
04
Block on the pattern rules
Enforcement on the formats whose precision has been measured. A rule described in words keeps reporting, because nothing running after the send can stop one.
If every phase runs to its minimum How far it slides if they all run long
Straight answers
We have no regulated data. Why would we need this?
Because the detectors that fire on regulated data are the ones that will report nothing on your fleet, and a quiet console reads as safety. What leaves a manufacturer is design and commercial detail, and it is matched by rules you write rather than by a framework somebody else wrote.
Can it recognise our part numbering?
Yes. A custom rule has one matcher: a regular expression, which runs in the agent inside the 250 ms deadline and can block; or an entity type described in your own words, which runs on the on-device model after the send and reports only. Part numbers are almost always the first kind.
Does it read the CAD and Office files people attach?
Office formats, PDFs and plain archives are read on the device. Native CAD formats are not, and the event says the file was unscanned rather than recording it as clean.