Common Approaches
These are just examples. Send us a message if you’re unclear — we’re glad to help!
Transfer methods
Company-managed devices restrict common ways documents could be moved outside the company. Examples include:
- Restricting access to logging into personal email accounts
- Restricting access to personal cloud-storage accounts (Google Drive, Dropbox, etc.).
- Outbound email quarantine on messages with attachments sent to external and personal domains.
- Removable-media restrictions — blocking copying to USB drives or other external storage.
Watermarking
Downloaded documents contain the company name, logo, or another identifying mark — Aquamark or equivalent. Awareness that documents can be traced back to the company creates a reasonable deterrent to misuse.
Activity monitoring + policy
User activity, including document downloads, is logged and subject to review, alerts, or other oversight. Personnel also sign a policy acknowledging that their activity is monitored. The principle is similar to visible security cameras: knowing your actions are being observed and can be traced back to you helps deter misconduct. Sample policy
Other
Every company operates differently. If you use another approach, contact us or describe the safeguard in the applicant portal for review.
Additional Enterprise Controls
Larger organizations, companies with multiple locations, or teams with more complex environments may already use broader enterprise security controls. These are additional options, not certification requirements.
- CASB / Security Service Edge controls (e.g. Netskope) — applies access and data controls across cloud applications, such as restricting personal accounts, downloads, uploads, syncing, or use from unmanaged devices.
- Enterprise browser or browser isolation platforms (e.g. Island) — can restrict downloads, copy/paste, screenshots, uploads, or other data movement within specific apps.
- Data Loss Prevention (DLP) platforms (e.g. Microsoft Purview DLP) — detects sensitive information and applies rules to prevent or restrict unauthorized sharing through email, uploads, cloud apps, or other transfer methods.
- MDM / endpoint management platforms (e.g. Intune, Jamf) — centrally applies and enforces device-level security policies regardless of the network being used.
- Centrally managed browser policies (e.g. Chrome Enterprise/Google Admin, Microsoft Intune, Group Policy, Edge for Business) — restrict browser sign-in to approved company accounts, block specific websites, or enforce other browser-level controls.
- Secure web gateways / DNS filtering — rules enforced through a firewall, secure web gateway, DNS filtering service, or managed device that block access to selected domains such as personal email or cloud-storage sites.