Cloud/AI Governance/DLP Protection
DLP Protection
Data Loss Prevention for your fleet: the global shielding switch and the redaction patterns that mask emails, passwords, credit cards and thirty other sensitive field types before any AI response leaves.
DLP Protection is where you decide what the AI is never allowed to repeat. The screen opens with the Global Data Shielding switch and its rule: "Define default redaction patterns applied to every conversation in this workspace." When it is on, every response that crosses Vinkius has the protected fields redacted before it reaches the AI client. When it is off, the editor says so plainly: "Enable DLP to configure redaction patterns."
Global Data Shielding
Define default redaction patterns applied to every conversation in this workspace.
Add pattern
* matches any object. *.email protects every email field, items[*].credit_card protects array items.
*.email*.password*.secret*.credit_card*.card_number*.ssn*.phone*.api_key*.token*.date_of_birth*.ip_address*.bank_account*.ibanThe mockup is the real editor: type "card" in the input to see the suggestion list filter, add a pattern, then hover a row and remove it through its confirmation dialog. Nothing leaves this page.
The pattern language
The input takes JSON paths and the console teaches the syntax right under the field: " matches any object. .email protects every email field, items[].credit_card protects array items." So `.email shields the email field of every object in every response, and items[*].credit_card` shields a credit card inside any array. One pattern, total coverage of that field shape.
The suggestion list does the knowing for you
You do not need to guess field names. Typing in the input opens a suggestion list with the console's full catalog of sensitive field types, from *.email ("Email addresses") through *.credit_card ("Credit card numbers"), *.ssn ("Social Security Number"), *.iban, *.api_key ("API keys"), *.token ("Auth tokens"), *.date_of_birth and more. Pick one and it joins the protected list; duplicates are filtered out automatically.
Your protected fields
The list below the input is the fleet's redaction contract. Out of the box the console ships thirteen defaults: *.email, *.password, *.secret, *.credit_card, *.card_number, *.ssn, *.phone, *.api_key, *.token, *.date_of_birth, *.ip_address, *.bank_account and *.iban. Each row has a remove action that asks first: "Remove redaction pattern?", with the honest consequence spelled out: "This field will no longer be masked from AI responses." Removing a pattern is a decision, not a slip.
Why this screen exists
Every conversation your agents have crosses systems you may not control, and the model will happily repeat whatever an upstream API returns. These patterns are the line the data never crosses: the field is masked in flight, the response stays useful, and the PII never reaches the AI client. The Security Posture report counts the result: every redaction it charts was applied by the patterns on this screen. The footer links the console's DLP documentation for the deep rules.