Teramind DLP: data loss prevention for insider risk

What Teramind DLP is

Teramind sells three standard plans (Starter, UAM and DLP) and a custom Enterprise & Government plan. Teramind DLP is the plan built for data protection: its knowledge base describes it as everything in Teramind UAM plus sensitive data discovery and classification, content-sharing rules, fingerprinting and compliance management.

The difference from many data loss prevention products is where it works. Teramind is an endpoint tool focused on data in use. The agent inspects content as a person interacts with it (sending an email, copying text, uploading a file, typing into a web form or an AI chat) and enforces your rules on the computer, with the full activity record behind each alert.

Teramind is open about what it does not do: it does not run scheduled scans of data at rest on file servers or databases. If you need to discover and label stored data across Microsoft 365, that is a job for a tool such as Microsoft Purview, and Teramind DLP can then act on Purview's labels (see below); our Teramind vs Microsoft Purview page compares the two approaches to insider risk. For data loss prevention at the email gateway, in cloud apps or across the network, see our sister site's guide to data loss prevention.

What the DLP plan adds over UAM

Teramind's plan comparison and pricing page list these DLP-plan features on top of UAM:

• Content-based behaviour rules: rules that look inside files, emails, instant messages, clipboard data, keystrokes and AI prompts for sensitive content.
• Sensitive data discovery and classification: built-in definitions for personal data, health data, financial data such as card numbers and source code snippets, plus your own custom definitions.
• Redaction of sensitive content: listed by Teramind as a DLP-plan feature.
• Automatic DLP blocking: the agent stops a transfer that matches a rule rather than just reporting it.
• Clipboard content inspection: UAM records copy and paste activity, but inspecting clipboard content in rules needs DLP.
• Fingerprinting and tagging: matching specific text or binary content inside documents, and detecting document properties and tags.
• LLM content rules: content rules for prompts and file uploads in AI tools; see employee AI usage monitoring.
• Microsoft Purview integration: detecting Microsoft Purview Information Protection sensitivity labels inside Teramind rules.
• In-app fraud detection and pre-packaged DLP rule templates to start from.

UAM already gives you activity rules (for example, block uploads to personal cloud drives or copies to USB storage), anomaly detection and risk scoring. DLP is the step up when the decision depends on what the data is, not just where it is going.

Plan comparison: UAM, DLP and Enterprise

How the data protection features line up across Teramind's plans, from Teramind's knowledge base and pricing page:

Teramind licenses Starter, UAM and DLP per monitored user with a five-seat minimum, on monthly or annual terms; Enterprise is priced to order. We do not publish prices; see Teramind pricing and plans for the full comparison, and ask us for a quote.

How Teramind DLP classifies sensitive data

Teramind's DLP guide describes a three-step approach: classify the data, enforce rules, investigate incidents. Classification is where the work starts:

• Predefined categories: personally identifiable information (names, addresses, dates and similar identifiers), financial data (card numbers, SWIFT and other banking codes), health data, and code snippets in common languages.
• Custom definitions: keywords and phrases, regular expressions for formats such as your invoice or project numbers, and shared lists you can reuse across rules.
• File properties: rules can read document properties and tags, for example blocking any file tagged "internal only" from leaving the organisation.
• File and clipboard origin: rules can depend on where content came from or is going, such as a network share, cloud storage or a specific web application like your CRM.
• Purview labels: if you already classify data in Microsoft Purview Information Protection, Teramind can detect those labels in its rules. Teramind says this integration is currently set up through its Legacy interface.

On fingerprinting, Teramind's own guide is specific: it does not keep a fingerprint database of your documents, but rules can look for particular text or binary content inside files. That suits most "stop this kind of data leaving" rules; it is worth knowing if you are comparing it with tools built around document fingerprinting.

Enforcement: warn, block, record or lock

Once Teramind recognises sensitive content, the rule decides what happens. Rule actions include:

• Warn: show the user a message explaining the policy, which turns a near miss into a moment of training.
• Notify: alert your security or compliance team.
• Block: stop the transfer, email or upload.
• Record Video: capture the screen before and after the event as evidence.
• Lock Out User: lock the session for high-risk events.
• Redirect and Command: send the user to another page, or run a script on the endpoint.

Risk levels can step up with frequency, so a first slip might warn while repeated attempts block and notify. Each alert lands in the Behavior Alerts dashboard with a link to the recording, and the insider threat detection software page covers the investigation side in more detail.

For screen content, Teramind offers dynamic blackout: applications and websites you exclude from monitoring are blacked out in recordings and live view. Field-level blackout, hiding specific fields inside an app, is available as a custom implementation.

Limits worth knowing before you buy

Under-promising is part of a sensible DLP project, so here are the constraints Teramind documents:

• Data in use only: no scheduled scanning of data at rest on servers or databases.
• File formats: Content Sharing rules support modern Office formats (.docx, .xlsx) but not the older .doc and .xls formats.
• Large files: the agent allows a short, fixed time to scan each file and skips files it cannot finish in time, so very large files may not be inspected. For AI uploads over 5 MB, only the first 1 MB is inspected.
• Operating systems: content rules are fullest on Windows. On macOS, content definitions are limited to text, clipboard monitoring is not supported and AI usage content rules cover only Microsoft Copilot on the web. Linux supports content rules with some criteria missing.
• Mobile devices: Teramind does not support phones or tablets.
• Interface: some integrations, including Purview and SIEM, are available only through Teramind's Legacy interface at the moment.

They shape how you design rules, so we can go through them with you at scoping.

Content inspection and UK data protection law

DLP reads the content of what people send and type, which puts it at the intrusive end of monitoring. The ICO's guidance on monitoring workers says you must carry out a DPIA before monitoring that is likely to result in a high risk, gives keystroke monitoring as an example, and recommends a DPIA even where there is no specific high risk. Content rules may also catch special category data, such as emails to a union representative or occupational health, and the ICO says you need an extra condition under UK GDPR if your monitoring is likely to capture it.

Teramind's design helps here: rules can act automatically without anyone reading the content unless an alert fires, recordings can be limited to rule violations, and role-based access control limits who sees what. Scope rules to the data you are protecting, exclude personal and sensitive channels where you can, and tell staff what the DLP rules do. See employee monitoring DPIA and monitoring employee emails at work. This is general information; take legal advice for your situation.

How Forever Systems helps

We supply Teramind DLP and can help with the work that makes it useful:

1. Data mapping. Agree what counts as sensitive for you and where it lives, and capture the technical detail for your DPIA.
2. Rule design. Start from Teramind's templates, build custom definitions and set actions that escalate sensibly from warn to block.
3. Pilot. Run rules in notify-only mode with a small group first, so you see the alert volume before anything is blocked.
4. Roll-out. Deploy the agent by GPO, SCCM, Intune or Jamf, with privacy settings in place from the start.
5. Tuning. We can help adjust rules as false positives appear, update agents and handle renewals.

Contact us to discuss your data protection goals and get a quote.