AI DLP Best Practices
Start with Visibility, Then Enforce
1 Log-Only Mode First
Before blocking or redacting, run policies in log-only mode for 1-2 weeks. This helps you understand what data is flowing to AI systems without disrupting workflows.
2 Review and Tune Patterns
Analyze logs to identify false positives and adjust patterns. Add exclusions for legitimate use cases (like support teams discussing test data).
3 Gradually Enforce
Move high-risk patterns (credentials, SSNs) to blocking mode first. Keep lower-risk patterns (emails, names) on alert mode until your team adjusts.
Pattern Strategy
- Block critical data - API keys, passwords, credit cards, SSNs should always be blocked
- Redact PII carefully - Names and emails may be necessary for context; consider redacting rather than blocking
- Custom patterns for your industry - Add patterns for internal codes, patient IDs, case numbers
- Exclude test data - Create patterns that ignore known test values (000-00-0000, etc.)
Create separate policies for different teams. Engineering may need to share code snippets; HR should never share SSNs to AI systems.
User Communication
- Announce DLP policies before enforcement
- Provide clear error messages explaining why requests were blocked
- Offer alternatives (approved internal AI tools, sanitization guides)
- Create a feedback channel for false positive reports
Canary Token Best Practices
Tracking requires internet access. The document must be opened on a device connected to the internet for the tracking pixel to load.
Testing Before Deployment
Always verify your canary tokens work before deploying:
- Create your tracking pixel
- Embed it in your document
- Save and close the document
- Open on a different device or network (mobile data works well)
- Verify the event appears in your dashboard
- Check that all data looks correct
Testing from a different network helps ensure the pixel works outside your office environment where it might be cached or blocked.
Placement Tips
- Size the pixel at 1x1 pixels - Invisible to viewers
- Place in document headers/footers - These load even when skimming
- Avoid placing near images - Some apps load images on-demand
- Test in the actual application - PDF readers, Word, and browsers behave differently
Common Use Cases
AI DLP Use Cases
| Use Case | Recommended Policy |
|---|---|
| Prevent credential leaks | Block all API keys, passwords, tokens |
| HIPAA compliance | Block SSNs, medical record numbers, health conditions |
| PCI compliance | Block credit card numbers, CVVs, bank accounts |
| Protect IP | Block internal project codes, proprietary terms |
Canary Token Use Cases
| Use Case | What to Look For |
|---|---|
| Detect data breaches | Any access to decoy documents indicates compromise |
| Track contract reviews | Verify intended parties are reviewing |
| Monitor insider threats | Unexpected access patterns or locations |
| Verify document delivery | Confirm recipients opened critical documents |
| Detect IP theft | Access from competitor organizations |
Understanding Limitations
AI DLP Limitations
- Only scans text - Cannot detect sensitive data in images or files
- Context matters - "John Smith" might be sensitive or might be a public figure
- Encrypted content - Cannot scan end-to-end encrypted messages
- Evasion possible - Determined users can obfuscate data
Canary Token Limitations
- Offline viewing - Documents opened without internet access
- Blocked images - Organizations that block external content
- Print copies - Physical printouts cannot be tracked
- Screenshots - Screenshots of documents won't trigger tracking
- Location accuracy - IP geolocation is approximate; VPN users show VPN location
Signal Canary provides powerful security intelligence, but is not a complete security solution. Use it as part of a layered defense strategy.
Ethical Use
Signal Canary is designed for legitimate security purposes:
- Protecting sensitive business data
- Detecting and preventing data breaches
- Compliance with data protection regulations
- Insider threat investigation
Always ensure your use complies with applicable laws, regulations, and organizational policies. When in doubt, consult your legal team.