Resources · FAQ
Frequently asked questions
Direct answers on what GuardStance detects, how it deploys, what it stores and how to evaluate it.
Book a demoGeneral
What is DLP (data loss prevention)?
DLP is the set of technologies and processes that stop sensitive data leaving without permission. Modern DLP covers far more than email: endpoints, web, cloud applications, USB devices and AI services are all channels where data moves, and leaks.
What makes GuardStance different from traditional DLP?
Three things. AI data security is part of the core platform, so you see what people send to AI services, with content and context. Detection runs on a single engine. And decisions are not binary: monitor, warn, record and block follow the context.
Which modules make up the platform?
Data Discovery & DSPM, Data Classification, Endpoint DLP, Network & Email DLP, Cloud DLP, AI Firewall, AI Data Security, the Detection Engine and Investigations & Insider Risk. The platform is modular, so you can start with what you need and expand.
Does it only detect structured data such as card or ID numbers?
No. Card, ID, tax and IBAN numbers are checked by checksum, not by format alone, which cuts false positives. Document fingerprinting and content analysis also detect unstructured assets such as designs, source code, pricing models and formulas. OCR covers scanned documents and images.
Technical
Is it agent-based or agentless?
Both. A lightweight endpoint agent controls data movement and inspects content locally. Discovery on network shares runs agentless from the management appliance, so no agent is needed on the file server.
Which operating systems are supported?
Windows, with a signed MSI installer and silent deployment through Group Policy, and Linux, with packages for Debian, Ubuntu, RHEL, Rocky and SUSE. For macOS, contact our sales team for current coverage. The management appliance is a single virtual machine.
Does it affect endpoint performance?
The agent stays under a CPU cap that you can adjust by policy, and it throttles itself as it nears that cap. We recommend measuring memory and disk impact on your own hardware during the POC, and we review the measurements with you.
Does it work with our existing labeling tools?
Yes. GuardStance reads existing labels as one of the detection engine’s inputs and connects them to policy. Platform labels can be mapped to Microsoft sensitivity (MIP) labels in Office documents. Interoperability with other labeling tools is checked in your POC.
Is there SIEM or SOAR integration?
Yes. Events and the audit log go to your SIEM over syslog, in CEF or RFC 5424 format, using TCP or TLS. Only metadata is sent, never the sensitive content. A JSON REST API and CSV or JSON export can feed SOAR and reporting workflows.
AI Data Security
Which AI services can we see?
Generative AI sites such as ChatGPT, file uploads to Teams, Slack and Discord, WhatsApp Web, file-sharing sites and cloud storage. For some services content is inspected; for others an access or upload decision applies. We share the exact coverage table before a POC.
Can it tell a corporate AI account from a personal one?
Yes. Telling corporate and personal accounts apart is part of evaluating context. You can allow uploads to a corporate account while blocking the same content going to a personal one, on the same service.
What is Shadow AI, and how do we manage it?
Shadow AI is the use of AI tools without the organization’s approval or knowledge. GuardStance first makes that use visible: which user, which service, what content. You can then start with monitoring and warnings, rather than blocking everything.
Do we have to block AI entirely?
No, and we do not recommend it. The goal is to keep people productive while stopping sensitive content leaving: monitor, warn, record or block by content type, account and context. A user can also give a reason and continue.
Deployment
Which deployment models are available?
Four: on-premises, for regulatory and air-gapped needs; private cloud, inside your own infrastructure; managed, where we operate the platform for you; and an MSSP model through a service provider.
Does our data leave the country?
In on-premises and private cloud models, data stays in infrastructure you choose. Scanned content and detected values never leave the management appliance, and the product runs with full functionality without internet access. The architecture overview shows where everything sits.
How long does deployment take?
It depends on scope. Most of the time goes into rollout: directory integration, choosing what to scan, the first scan, tuning and agent deployment. Production timelines depend on the number of endpoints, and are set out in a written roadmap.
Privacy and trust
What data does GuardStance inspect and store?
We document what is inspected, what incident records hold, where they are stored, for how long and who can read them. Events, scan history and daily summaries are kept for 400 days by default, and the audit log for 24 months. You can shorten both.
Are copies of sensitive content kept in incident records?
Incident records hold which detector matched and the matched values. Authorized analysts see them for investigation, and notifications to users mask the value. A file is captured only by rules with the shadow copy action. Evidence is encrypted, and every access is recorded.
How does it support GDPR and other data protection rules?
GuardStance strengthens the technical side of your program: finding personal data, monitoring its movement and stopping unauthorized transfers. It produces audit evidence such as a personal-data inventory and period comparisons. Please confirm legal questions with your counsel.
Buying and POC
Can we test it with our own data before buying?
Yes, and we encourage it. The POC has four stages: define the data and success criteria, configure policies, test realistic scenarios, then evaluate the results. The POC guide sets it all out.
How does licensing work?
Licensing is structured by number of endpoint agents, selected modules and a 1, 2 or 3-year term. The license is bound to the appliance and activated offline with a license file. For a quote, write to sales@guardstance.com.
Can we buy modules separately?
Yes. The platform is modular, so you can buy what you need first. For example, start with Endpoint DLP and AI Data Security, and add Data Discovery & DSPM and Investigations in a later phase.
Is it hard to move from our current DLP product?
No. Rules and policies from your current product can be imported, and items without an equivalent are reported. Imported rules run in monitor mode first for comparison, and you complete the switch once you are confident.
Support
How do we get support?
Write to support@guardstance.com. Target response times depend on the severity of the issue and on your support agreement. The Support page explains the severity levels and what to include in a ticket.
In which languages is support available?
English. The management console is fully available in English, and support coverage and hours are defined in your license or support agreement. Partners can give first-line support to managed and MSSP customers.