Klipsu SentinelClipboard DLP you host yourself

See when credentials, customer data and confidential documents pass through the clipboard, without ever reading your employees' clipboards.

Product overview

How it works

Security and privacy

Detection on the device

Rules run inside the Klipsu app on each laptop and phone. Copied text is checked where it is copied and never uploaded for scanning.

How detection works

Masked findings only

Security sees the rule, a masked match such as AKIA••••7Q2F, the source app, device and time. Sentinel re-checks every mask it receives.

Masking styles

Sealed evidence on request

The matched clip stays encrypted on the device. An investigator requests it with a written reason and opens it with a passphrase Sentinel never stores.

Evidence investigations

Your infrastructure

One binary for Linux or Windows plus PostgreSQL. Clipboard sync stays end-to-end encrypted, and nothing is sent to Klipsu.

Requirements

Accountable by design

Four roles, two-factor authentication, pseudonymisation for analysts and a hash-chained audit log that the console verifies.

Audit log

Fits your SOC

Send alerts to your SIEM over syslog (RFC 5424 or CEF), to signed webhooks or to Slack, with retries and delivery history.

Integrations

The clipboard is the blind spot in your DLP

API keys pasted into AI assistants. Customer records copied into chat. Excerpts of a board memo shared before an announcement. Sentinel shows your security team what leaves through the clipboard and gives employees a tool they actually want to use.

Sentinel console overview with devices online, findings, matches by rule and recent alerts

Privacy is the architecture, not a setting

Sentinel was designed so that the organisation learns what it needs to protect data and nothing more. Works councils and data protection officers can review exactly what is reported before rollout.

No clipboard content on the serverClipboard history is end-to-end encrypted with keys only the employee's devices hold.
Minimum necessary reportingPer-rule masking decides exactly how much of a match anyone can see.
Evidence only with a reasonEvery request, upload and opening is written to the tamper-evident audit log.

Built for the people who run it

A single static binary with the console and migrations embedded. PostgreSQL is the only dependency, and it scales out behind a load balancer.

Linux and WindowsHardened systemd unit and a native Windows service installer.
Air-gap friendlyNo telemetry, no license server, no update checks.
Operational toolingHealth endpoints, structured logs, key rotation, offline licensing.

Investigate with context, not with clipboards

Alerts group related findings by person, device and rule. Analysts triage, assign and comment, and request sealed evidence only when a masked match is not enough.

Alert detail with masked matches, actions taken on the device and evidence request

Bring Klipsu to your organisation

Evaluate Sentinel on your own infrastructure. Talk to us about licensing, pilots and rollout with your employee representatives.

Contact sales Installation guide