Swif's Data Loss Prevention (DLP) feature monitors outgoing emails in real time and blocks messages that violate your organization's data security policies — before they ever leave your outbox.

DLP protects sensitive information from being sent through web-based email applications. When enabled, Swif's browser extension inspects outgoing email content at send time. If a policy violation is detected, the email is blocked instantly — it will not be sent and will not appear in your Sent folder.

DLP operates entirely within the browser. There is no need to install additional software or configure email server rules.

Before you can enable Data Loss Prevention (DLP), you must first subscribe to beta features at the organization level. By default, beta features are opted-out for all new and existing organizations.

For Admins:

Note: While the feature flag is organization-wide, specific DLP rules are still configured at the team level under Organization Settings > Team.

Note: DLP currently covers the web versions of Gmail and Outlook accessed through a supported browser with the Swif extension installed. Native desktop mail clients are not covered at this time.

Swif DLP inspects email body text in real time against a wide range of sensitive data patterns and compliance identifiers:

Note: Swif's classifier is optimized to prevent false positives — routine business discussions (such as discussing password rotation policies or sending links to public documentation) will not trigger security warnings.

DLP rules are managed at the team level by your organization administrator. This granular control allows you to apply specific security policies to different employee groups and applications.

Prerequisite:
Before configuring rules, ensure that Beta Features are enabled in your Organization Settings. As a beta feature, the Data Loss Prevention tab will only be visible in Team Settings when this toggle is ON.

For Admins:

Managing Existing Rules:

Privacy & Data Security

Swif is designed with a privacy-first approach. While the DLP Events Dashboard provides visibility into policy violations, Swif never stores the raw body text or sensitive data from your emails.

For DLP rules and events, Swif only persists metadata required for reporting and audit trails, such as:

This ensures that administrators can monitor security trends and policy enforcement without compromising employee privacy or storing sensitive message content.

Privacy in Exported Reports

When exporting DLP reports (CSV or JSON), Swif strictly excludes the raw body text, message contents, and attachment payload data. Exported files contain only metadata (timestamps, employee identifiers, application names, triggered rule categories, and evaluation decisions) to maintain compliance and confidentiality.

Administrators can monitor DLP activity and policy enforcement in real time through the DLP Events Dashboard. This centralized view provides visibility into blocked actions, event trends, and detailed logs across the organization.

For a comprehensive guide on how to use these reporting features, see our article on Monitoring Data Loss Prevention (DLP) Events.

DLP also supports server-side detection through connected integrations, providing an additional layer of coverage beyond the real-time browser block.

Administrators can generate and export comprehensive DLP event reports for compliance auditing, internal security reviews, or external analysis.

DLP event exports include structured metadata while strictly maintaining privacy:

A: No. Policy evaluation happens in milliseconds at send time. You will not notice any delay for compliant emails.

A: You'll see a notification directly in Gmail or Outlook explaining the block. Your email draft is preserved — you can edit it and try again.

A: No. DLP only inspects the email at the moment you click Send. It does not monitor drafts, keystrokes, or content in real time while composing.

A: Not currently. DLP covers Gmail and Outlook web apps only, accessed through a browser with the Swif extension installed.

A: No. DLP is off by default and must be explicitly enabled by your team administrator in Team Settings.

A: DLP requires an active browser extension connection. If the extension is disabled or not present, DLP enforcement will not apply.

A: The block notification will indicate that a DLP policy was triggered. Contact your administrator for details on your organization's specific policy rules.

A: Swif detects credentials (passwords, bearer tokens), private keys, payment card & banking data, government IDs (SSNs, passports), health/PII records, and confidential business terms.

A: When a warning modal appears upon clicking Send, users can select Cancel Send to return to their draft and edit the content, or Send Anyway if authorized to proceed.

For questions about your organization's DLP policies, contact your Swif administrator.

A: You can export DLP event reports in either CSV or JSON format.

A: Yes. Exports support up to 100,000 records per request. For larger historical datasets, adjust the date range picker or apply multi-select filters to export records in targeted batches.

A: No. In accordance with Swif's privacy-first architecture, raw message bodies and sensitive contents are never stored or included in CSV/JSON exports. Only audit metadata and violation trigger reasons are included.

A: Only authenticated team administrators with access to the Swif dashboard can generate and download DLP event reports.