Platform · Data Classification
Know Your Data. Classify It with Confidence.
Sensitive information is rarely labeled consistently. GuardStance Data Classification discovers data across your environment and applies persistent sensitivity labels using content inspection, context analysis, existing MIP tags, and custom rules.
See Data Classification in ActionWhen a File Looks Ordinary but Contains Sensitive Data
An employee prepares to share a spreadsheet containing customer information. Although the file has a generic name, its contents match an established sensitive data classification policy.
GuardStance uses the classification label immediately to drive protection decisions across every channel. Security policies act on what is actually inside the file—not just what the file is named.
- Data
- Spreadsheet with a generic name and customer records
- User
- Employee preparing to share it
- Destination
- External email or cloud upload
- Policy
- Customer data is Confidential
- Decision
- Record classified by its content
How does classification work?
-
Scan
Endpoints, file servers, NAS, SharePoint and cloud drives, on a schedule or continuously.
-
Recognize
Content, context, existing labels and your own rules decide what the file is.
-
Label
A visual label and a metadata tag travel with the file.
-
Act
DLP policies use the label the moment the file moves.
What does it cover?
-
Discovery everywhere
Endpoints, file servers, NAS, SharePoint and cloud drives, from the same agent.
-
Visual and metadata labels
A header, footer or watermark, plus a metadata tag.
-
Automatic or user-chosen
Labels set by content, or chosen by the user when saving.
-
Mislabeled files
A file marked Public that holds card numbers is flagged.
-
Remediation
Move, quarantine, encrypt, notify the owner or open a case.
-
Exposure reports
Files shared with everyone, external links and stale data.
Questions about Data Classification
Why put classification and DLP in one product?
Every label is a signal the enforcement policies can use. When the same agent labels a file and later sees it move, the decision uses what the file really is, not just where it is going. There is one rollout and one policy to maintain.
Does it work with Microsoft sensitivity labels?
Yes. Platform labels can be mapped to Microsoft sensitivity (MIP) labels in Office documents, and existing labels are read as one of the signals when a file is classified. Interoperability with other labeling tools is checked in your POC.
Will people notice the scans?
Discovery runs on a schedule or continuously and is throttled, so people keep working as usual. Results arrive in the console as an inventory of where sensitive data sits, who owns it and who can reach it.