OEM knowledge base
What DLPST knows about each vendor, exactly as collected from the vendor's own website and documentation - every line links to its source. Items that could not be verified on an official page are listed separately and are never used as facts.
Proofpoint
Human-centric Enterprise DLP: Endpoint DLP & ITM, Email DLP, Cloud DLP and DSPM · research date 2026-09-18
Products
| Product | Category | Delivery | Description | Source |
|---|---|---|---|---|
| Proofpoint Enterprise DLP (DLP Transform tiers; Data Security Workbench console) | Unified multichannel DLP (email, cloud, endpoint, GenAI) | saas | Unified cloud-native DLP across email, cloud apps, endpoints and GenAI apps with one console (Data Security Workbench), shared detectors (Regex, OCR, IDM, EDM, MIP classification), 110+ AI classifiers, LLM-based Autonomous Custom Classification, data lineage. Sold as DLP Transform Tier 1 / Tier 2 plus add-ons. Multi-tenant, supports hundreds of thousands of users per tenant. | proofpoint.com |
| Proofpoint Endpoint DLP / Insider Threat Management (ITM) SaaS | Endpoint DLP + insider risk (UAM, visual capture) | saas, endpoint_agent | Single lightweight user-mode agent (Windows, macOS, Linux) for DLP and ITM, managed from the Proofpoint Data Security SaaS platform. Licensing options: Endpoint DLP-only, Full ITM, or mixed-mode (Endpoint DLP is a subset of ITM). Screenshots (visual capture) are optional/ITM. | docs.public.analyze.proofpoint.com |
| Proofpoint ITM On-Prem (formerly ObserveIT) | Insider threat / user activity monitoring with session recording (on-premises) | on_prem | Customer-hosted: Windows/macOS/Unix-Linux agents, IIS/ASP.NET Application Server(s), Web Console, Microsoft SQL Server database, optional file share for screenshots, load balancer for multiple app servers. Current doc version 7.18.1. | prod.docs.oit.proofpoint.com |
| Proofpoint Email DLP and Encryption | Email DLP + email encryption | saas_gateway, on_prem_appliance, virtual_appliance | Outbound email DLP on the Proofpoint email gateway (PPS on-prem or PoD cloud) via the Regulatory Compliance module; hundreds of prebuilt identifiers/dictionaries, 300+ file types, fingerprinting (full/partial), IDM, EDM, OCR; policy-based encryption (Secure Reader, Secure Reader Inbox, Outlook add-ins, internal-to-internal, TLS fallback, Trusted Partner Encryption). Integrated with Unified DLP. | proofpoint.com |
| Proofpoint Adaptive Email DLP | Behavioral-AI email DLP (misdirected email, wrong attachment, exfiltration to personal accounts) | saas, outlook_add_in | ML models trained on 12+ months of historical email learn relationships; warns desktop users in real time via Outlook integration and mobile users via bounceback emails (message held at gateway). Deployable in about 48 hours. Per the solutions architecture paper, it did not then integrate with the Information Protection platform. | proofpoint.com |
| Proofpoint Email Protection / Proofpoint Protection Server (PPS) / Proofpoint on Demand (PoD) | Secure email gateway (hosts Email DLP/Encryption modules) | saas, on_prem_appliance, virtual_appliance, hybrid, api | Email gateway deployable as cloud service, virtual appliance or hardware appliance (cloud, hybrid, on-prem). Hardware P-series appliances can be provisioned with Email Protection and Information Protection. Newer Core Email Protection also offers Microsoft Graph API deployment (48 hours, no MX change). | proofpoint.com |
| Proofpoint Cloud DLP (formerly Proofpoint CASB) | CASB / SaaS DLP / cloud threat | saas, api, proxy | Multimode CASB: API connectors (agentless), Adaptive Access Controls via SAML/OIDC, cloud proxy (forward/reverse), optional SaaS Isolation add-on for DLP on unmanaged/BYOD. 240+ built-in classifiers, shadow IT catalog of 46,000 apps with 50+ attributes, OAuth app governance, ML insider-risk models. IaaS (AWS/Azure) API monitoring charged separately. ICAP integration with Zscaler and Citrix ShareFile. | proofpoint.com |
| Proofpoint DSPM (formerly Normalyze) | Data Security Posture Management | saas, customer_cloud_scanner, on_prem_container_scanner | Agentless, in-place scanning: scanner resources deployed in the customer's AWS/Azure/GCP account (or as a sidecar), only results sent back. Covers IaaS/PaaS data stores, SaaS (M365 SharePoint/OneDrive/Teams, Google Drive, Salesforce), Databricks, Snowflake, on-prem databases and Windows file shares. AI classification, access governance, AI data governance (Bedrock, Azure ML, Vertex AI), 200+ prebuilt risk findings, MIP label apply (beta). | proofpoint.com |
| Proofpoint Data Security Complete / Information Protection platform (Nexus, formerly 'Sigma' platform) | Data security platform bundle | saas | Bundle of multichannel DLP (email, cloud, web, endpoint), ITM, DSPM and AI Data Governance module; AI-generated classifiers, Data Risk Map, cross-channel lineage (Nexus), one-click remediation for M365/Google Workspace. Platform is fully SaaS; Proofpoint Sigma Platform referenced in privacy sheet. | proofpoint.com |
| Proofpoint Web Security (with Browser Isolation) | Cloud SWG with inline DLP | saas, endpoint_client | Cloud-native SWG (SSL inspection, URL/category filtering, sandboxing, inline upload/download DLP with 240+ detectors and EDM, browser isolation); shares endpoint client with CASB; Windows and macOS. Datasheet dated 12/2021; current availability not confirmed on a 2026 page. | proofpoint.com |
Architecture components & published requirements
| Component | Role | Minimum | Recommended | Capacity | Source |
|---|---|---|---|---|---|
| Proofpoint Data Security SaaS platform (Analytics / Administration / Data Security Workbench)SaaS (AWS regions US1, EU1, JP1, AU1, CA1, ME1, IN1) | Multi-tenant cloud backend: event ingestion, analytics, detection rules, unified alert manager, agent policy/realm management, REST APIs, webhooks. Proofpoint fully operates DR. | Vendor-hosted; no customer hardware. | N/A | hundreds of thousands users per tenantCloud-native, multi-tenant, scales automatically. | proofpoint.com |
| ITM / Endpoint DLP Windows Agent (SaaS)Endpoint (silent/unattended install, MSI via standard software distribution) | User-mode agent: collects activity metadata, optional screenshots, content scanning (optional component), enforces prevention rules (block/warn/justify), browser extension (ZenWeb) for web/GenAI. Watchdog service self-heals; auto-updater; no reboot after install/upgrade. | 8 GB RAM / 5 GB disk - Intel i3 or higher, AMD equivalent or ARM64; at least 8 GB physical RAM with at least 2 GB available for agent activity; at least 5 GB free disk; 100Mb/1Gb Ethernet. | 8 GB RAM / 5 GB disk - Intel i5 or higher recommended; 1 Gb network recommended. | - | docs.public.analyze.proofpoint.com |
| ITM / Endpoint DLP macOS Agent (SaaS)Endpoint | Same as Windows agent; requires privacy settings via mobileconfig for notifications/screenshots; launchd restarts agent. | 8 GB RAM / 5 GB disk - 1.6 GHz or faster Intel Core or Apple Silicon; 8 GB RAM or more; 5 GB free disk; 100Mb/1Gb Ethernet. | Not separately documented. | - | docs.public.analyze.proofpoint.com |
| ITM / Endpoint DLP Linux Agent (SaaS)Endpoint | Linux endpoint agent (desktop environments x.org; Wayland on KDE/GNOME). | 8 GB RAM / 5 GB disk - 1.6 GHz or faster processor; 8 GB RAM or more; 5 GB free disk; 100Mb/1Gb Ethernet. | - | - | docs.public.analyze.proofpoint.com |
| Proofpoint ZenWeb browser extensionEndpoint browser | Browser extension used with the endpoint agent to monitor web and GenAI activity (ChatGPT, Gemini, Copilot, Claude, DeepSeek, Perplexity, etc.). | See agent requirements. | - | - | docs.public.analyze.proofpoint.com |
| ITM On-Prem Application ServerOn-prem Windows Server (physical or VM) | ASP.NET app on IIS; receives agent data, analyzes/compresses, manages recording policies, storage, archiving, reports. Multiple app servers behind a network load balancer for scale/HA. | 4 cores / 8 GB RAM / 100 GB disk - 4-8 cores, 8-16 GB RAM, 100-200 GB OS disk (15K or SSD), 2 NICs 1 GbE. | 8 cores / 16 GB RAM / 200 GB disk - Upper end of range; 10 GbE recommended. | 500-750 CCU full recording (metadata + screenshots); 2,000-2,500 CCU metadata-only concurrent users (CCU) per Application ServerPer installation architecture guide. | prod.docs.oit.proofpoint.com |
| ITM On-Prem Web ConsoleOn-prem Windows Server | ASP.NET admin/review UI: audit review, video replay, reporting, configuration. Usually co-located with App Server. | 8 cores / 16 GB RAM / 80 GB disk - 8 cores, 16 GB RAM, 80 GB OS disk (15K or SSD), 1 NIC 1 GbE; plus 500 GB (15K/SSD) if SIEM integration via Monitor Log is used. | 8 cores / 16 GB RAM / 80 GB disk | - | prod.docs.oit.proofpoint.com |
| ITM On-Prem Database Server (Microsoft SQL Server)On-prem SQL Server (dedicated for medium/large) | Stores configuration, activity metadata (ObserveIT), analytics (ObserveIT_Analytics), screenshots by default (ObserveIT_Data), archives (ObserveIT_Archive_n). | 4 cores / 8 GB RAM / 100 GB disk - Small: 4-8 cores, 8-16 GB RAM (v7.18.1 doc; v7.13 doc says 16 GB), 100-200 GB OS disk, 2 NICs 1 GbE. Separate SSD volumes for tempDB, ITM DB, Data/Analytics DBs and logs; NTFS 64 KB blocks; archive DBs may use NL-SAS/SATA. | 32 cores / 256 GB RAM / 200 GB disk - Medium: 8-16 cores / 24-32 GB; Large: 16-24 cores / 64-128 GB; Extra-Large: 24-32 cores / 128-256 GB; 10 GbE recommended. | Small / Medium / Large / Extra-Large deployment tierTier-to-agent-count mapping for DB table not given; see installation architectures (Small <=300 CCU, Medium 301-3,000 CCU, Large 3,001-10,000 CCU). | prod.docs.oit.proofpoint.com |
| ITM On-Prem screenshot file storage (warm/hot)On-prem file server / DFS cluster | File-system storage of screenshots for medium/large deployments (instead of ObserveIT_Data DB); warm storage on local/network share, optional SSD hot storage; Screenshot Storage Optimizer compression. | Size from ~100 MB/user/day full recording or ~10 MB/user/day metadata-only. | - | 100 MB full recording; 10 MB metadata-only storage per user per day | prod.docs.oit.proofpoint.com |
| ITM On-Prem Agent (Windows/Mac/Unix-Linux)Endpoint / server | Captures user sessions, keystrokes, screenshots and sends to App Server (TCP 4884 default or 443 SSL); DNS SRV auto-discovery. | 4 GB RAM / 1 GB disk - 4 GB RAM or more; at least 1 GB free disk; 100Mb/1Gb Ethernet. | - | ~25-30 KB/s average (about 500 actions/hour, ~10 MB/hour) bandwidth per monitored sessionTypical screenshot + data per action 20-30 KB. | prod.docs.oit.proofpoint.com |
| Proofpoint Protection Server hardware appliances (P390 / P690 / P890 / P890M)On-prem hardware (Dell OEM) | On-prem email gateway hosting Email Protection and Information Protection (Email DLP/Encryption) modules. | 6 cores / 32 GB RAM / 500 GB disk - P390: 1x Intel Xeon E2136 6-core 3.3 GHz, 32 GB RAM (max 64), 2x600GB SATA 10K RAID1 (500 GB usable), 2x1GbE. | 24 cores / 128 GB RAM / 1600 GB disk - P690: 1x Xeon Silver 4310 12-core, 32 GB (max 512), 800 GB usable, 6x1GbE. P890: 2x Silver 4310 (24 cores), 64 GB, 800 GB usable. P890M: 2x Silver 4310, 128 GB, 6x600GB SAS 15K RAID1+0 (1.6 TB usable). | - | proofpoint.com |
| Proofpoint Protection Server hardware appliances (P380 / P680 / P880 / P880M) - prior generationOn-prem hardware | On-prem email gateway (previous generation). | 4 cores / 16 GB RAM / 500 GB disk - P380: Xeon E3-1220 v5 4-core 3 GHz, 16 GB (max 64), 500 GB usable. | 24 cores / 128 GB RAM / 1700 GB disk - P880M: 2x Xeon Silver 4116 (12-core each), 128 GB, 4x900GB SAS 15K RAID1+0 (1.7 TB usable). | - | proofpoint.com |
| Proofpoint Email Protection - virtual appliance / cloud (PoD)Virtual appliance / SaaS / hybrid | Email gateway as virtual appliance or cloud service; Email DLP enabled by licensing Regulatory Compliance module on existing gateway, or cloud gateway inserted as extra outbound SMTP hop. | Virtual appliance vCPU/RAM/disk requirements not published on public pages. | - | 99.999% service availability (cloud) cloud SLA | proofpoint.com |
| Cloud DLP (CASB) API connectors / Adaptive Access Control / SaaS IsolationSaaS | Agentless API connectors pull activity at intervals, scan files, remediate via vendor API (typically after a few minutes); SAML/OIDC adaptive access; SaaS Isolation for browser-based inline DLP on BYOD. | No customer infrastructure. | - | under 4 weeks time to deployDatasheet claim for API/IdP/SOAR integration. | proofpoint.com |
| DSPM in-account scanner (AWS / Azure / GCP)Customer cloud account (AWS/Azure/GCP) | Scanner resources created in the selected region of the customer's cloud account/subscription/project via onboarding script or Terraform; scans in place and sends only results to DSPM SaaS. Snapshot-based scanning for databases. Also used as 'sidecar' for SaaS (M365, Google Drive, Salesforce), Databricks and on-prem. | Cloud resource sizes not published; compute cost borne in customer account. | - | 30+ supported data store typesPer Normalyze/Proofpoint blog. | proofpoint.com |
| DSPM On-Premises Containerized ScannerCustomer Linux server/VM (on-prem or cloud) | Docker container scanning on-prem MSSQL, MySQL, PostgreSQL, Oracle and Windows File Shares; configured via JSON templates; scheduled via Scan Scheduler. | 8 cores / 32 GB RAM / 50 GB disk - Minimum 8 CPUs, 32 GB memory, 50 GB free disk. | Scaling guidance (scanners per data volume) not documented. | - | docs.public.analyze.proofpoint.com |
| DSPM On-Premises Cloud Sidecar ScannerCustomer AWS/Azure account + private connectivity | Scanner resources created in customer AWS or Azure account connect to on-prem data stores over VPN/Direct Connect/ExpressRoute; no Docker operations needed. | Not published. | - | - | docs.public.analyze.proofpoint.com |
Sizing rules
| Topic | Rule | Value | Source |
|---|---|---|---|
| Endpoint agent (SaaS) RAM | Windows endpoint needs >= 8 GB physical RAM with >= 2 GB available for agent activity | 8 GB total / 2 GB free | docs.public.analyze.proofpoint.com |
| Endpoint agent (SaaS) disk | Free disk space per endpoint (Windows/Mac/Linux) | 5 GB | docs.public.analyze.proofpoint.com |
| Endpoint agent (SaaS) CPU | Windows: Intel i3+/AMD equivalent/ARM64 (i5+ recommended); Mac/Linux: 1.6 GHz+ | i3 min / i5 recommended | docs.public.analyze.proofpoint.com |
| SaaS data retention | Customer selects platform retention; data securely deleted on a rolling basis after period | 30, 90, 120 or 366 days | proofpoint.com |
| SaaS retention/residency per realm | Agent Realms segregate agents by regional storage location and data retention period; entitlements define maximum retention per product and visual storage capacity | per Agent Realm | proofpoint.com |
| Data export | Activity data, alerts and events can be replicated to customer-owned AWS S3/Azure storage; runs every 15 minutes; no retention limit on exported data | 15-minute interval | proofpoint.com |
| Agent heartbeat / offline | Prevention rules enforced locally when cloud unreachable; policy changes picked up on heartbeat | heartbeat every 10 minutes | proofpoint.com |
| ITM On-Prem Application Server capacity | Concurrent users per Application Server | 500-750 CCU full recording; 2,000-2,500 CCU metadata-only | prod.docs.oit.proofpoint.com |
| ITM On-Prem storage per user | Average daily storage per monitored user | 100 MB/user/day full recording; 10 MB/user/day metadata-only | prod.docs.oit.proofpoint.com |
| ITM On-Prem deployment tiers | Small: all components on one server; Medium: multiple app servers + dedicated DB (24 GB RAM, 16 cores) + Web Console + unified warm/hot storage; Large: multiple app servers + DB (64-128 GB RAM, 24 cores) + Web Console + single warm storage + multiple hot storage | Small up to 300 CCU; Medium 301-3,000 CCU; Large 3,001-10,000 CCU | prod.docs.oit.proofpoint.com |
| ITM On-Prem all-in-one | Single server hosting App Server, Web Console, DB and file share | up to 100 concurrently connected users | prod.docs.oit.proofpoint.com |
| ITM On-Prem DB server tiers | SQL Server hardware by deployment size (2 NICs 1 GbE, 10 GbE recommended; OS disk 100-200 GB) | Small 4-8 cores/8-16 GB; Medium 8-16 cores/24-32 GB; Large 16-24 cores/64-128 GB; Extra-Large 24-32 cores/128-256 GB | prod.docs.oit.proofpoint.com |
| ITM On-Prem App Server hardware | Per Application Server | 4-8 cores, 8-16 GB RAM, 100-200 GB OS disk (15K/SSD), 2x 1 GbE | prod.docs.oit.proofpoint.com |
| ITM On-Prem Web Console hardware | Web Console server; add 500 GB disk if SIEM Monitor Log used | 8 cores, 16 GB RAM, 80 GB OS disk | prod.docs.oit.proofpoint.com |
| ITM On-Prem network | Typical user action (screenshot + data) 20-30 KB; moderate session ~500 actions/hour | ~25-30 KB/s per session (~10 MB/hour); compression can halve traffic | prod.docs.oit.proofpoint.com |
| ITM On-Prem SQL layout | Separate SSD volumes for tempDB, ITM DB, Data/Analytics DBs and transaction logs; NTFS 64 KB blocks; archive DBs can be NL-SAS/SATA; exclude AV from DB volumes; SQL Express not supported | SSD per volume | prod.docs.oit.proofpoint.com |
| ITM On-Prem scaling formula (derived) | App servers = ceil(peak CCU / 500..750) for full recording or ceil(peak CCU / 2,000..2,500) for metadata-only; storage = users x days retained x 100 MB (full) or 10 MB (metadata) | derived from vendor figures | prod.docs.oit.proofpoint.com |
| PPS hardware appliance sizing | Choose P390 (6-core, 32 GB, 500 GB) for smaller sites up to P890M (2x12-core, 128 GB, 1.6 TB RAID10) for large; throughput per model not published | P390 / P690 / P890 / P890M | proofpoint.com |
| DSPM on-prem scanner | Containerized scanner host minimum | 8 CPUs, 32 GB RAM, 50 GB disk, Linux x86_64, Docker 24.0+ | docs.public.analyze.proofpoint.com |
| DSPM scanning approach | In-account scanners; data not copied out; databases scanned from existing snapshots (point-in-time) rather than live queries | agentless in-place | proofpoint.com |
| DSPM MIP labeling cost | Applying MIP labels (SharePoint/OneDrive via Azure sidecar) incurs Microsoft Graph API cost | USD 0.00185 per API call | docs.public.analyze.proofpoint.com |
| Adaptive Email DLP model training | ML analyzes more than 12 months of historical email data | 12+ months history | proofpoint.com |
| Adaptive Email DLP deployment time | Deployment time | about 48 hours | proofpoint.com |
| Cloud DLP deployment time | Integrate cloud-service APIs, IdP and SOAR | less than four weeks | proofpoint.com |
| Tenant scale | Cloud-native multi-tenant platform | hundreds of thousands of users per tenant | proofpoint.com |
| EDM dataset scale | EDM service dataset size | tens of millions of rows, more than 10 columns | proofpoint.com |
Network ports
| From | To | Port | Protocol | Purpose | Source |
|---|---|---|---|---|---|
| Admin browser | https://<tenant alias>.explore.proofpoint.com and app.<region>.op1.op.analyze.proofpoint.com | 443 | HTTPS | Web console | docs.public.analyze.proofpoint.com |
| Endpoint agent | api.ingest.<region>.op1.op.analyze.proofpoint.com (US1: api.ingest.oitroot.us-east-1-op1.op.observeit.net) | 443 | HTTPS/TLS | Event ingestion to backend | docs.public.analyze.proofpoint.com |
| Endpoint agent | oitroot-op1-<region>-screenshots.s3.amazonaws.com | 443 | HTTPS | Remote screenshot storage | docs.public.analyze.proofpoint.com |
| Endpoint agent / updater | app.us-east-1-op1.op.analyze.proofpoint.com | 443 | HTTPS | Agent/updater version downloads | docs.public.analyze.proofpoint.com |
| Endpoint agent | mfe.protect.proofpoint.com, auth.proofpoint.com, flapi-on-k8s.us1.infoprtct.com, infoprtct-edm-us1.s3.amazonaws.com | 443 | HTTPS | Data classification config and EDM | docs.public.analyze.proofpoint.com |
| Platform components | flapi-<us1|eu2|au1|ca1|ae1|in1>.protect.proofpoint.com | 443 | HTTPS | Cloud DLP (CASB) services | docs.public.analyze.proofpoint.com |
| Endpoint agent | oitroot-op1-<region>-blobstore-01.s3[.<region>].amazonaws.com | 443 | HTTPS | On-demand agent log upload | docs.public.analyze.proofpoint.com |
| Proofpoint platform (NAT IPs e.g. US1 3.218.95.86/32, EU1 3.65.164.110/32) | Customer webhook receivers (SIEM/SOAR/ITSM) | 443 | HTTPS | Inbound webhook notifications; safelist per-region source IPs | docs.public.analyze.proofpoint.com |
| ITM On-Prem agent | Application Server (or load balancer VIP) | 4884 (default) or 443 (SSL) | TCP / HTTPS | Agent data upload | prod.docs.oit.proofpoint.com |
| ITM On-Prem App Server and Web Console | SQL Server | 1433 | TCP | Database access | prod.docs.oit.proofpoint.com |
| ITM On-Prem agent | DNS | 53 | UDP | SRV lookup _oit._tcp / _oits._tcp for App Server auto-discovery | prod.docs.oit.proofpoint.com |
| DSPM on-prem containerized scanner | DSPM SaaS URLs (onboarding prerequisites) | 443 | HTTPS outbound | Scanner control/results | docs.public.analyze.proofpoint.com |
| DSPM scanner | Windows file share host | 445 | SMB (TCP) | Scanning Windows File Shares (inbound on file share host) | docs.public.analyze.proofpoint.com |
| On-prem data store hosts (sidecar model) | https://api3.normalyze.io | 443 | HTTPS outbound | DSPM cloud sidecar scanning of on-prem stores (plus VPN/Direct Connect/ExpressRoute to cloud account) | docs.public.analyze.proofpoint.com |
Supported platforms
- Endpoint Os
- Windows 11 64-bit (23H2, 24H2, 25H2) - SaaS agent, Windows 10 (Microsoft-supported versions) - SaaS agent, Windows Server 2016/2019/2022 - SaaS agent (2025 for ITM On-Prem), Windows on ARM64, Azure Virtual Desktop, VDI master image (Citrix, Microsoft) - ITM On-Prem doc, macOS 14 Sonoma, 15 Sequoia, 26 Tahoe, 27 - SaaS agent (Intel + Apple Silicon), Linux SaaS agent: Ubuntu 22/24/26, Debian 13, RHEL 9/10, Fedora 43/44 (kernel 5.14+, x86_64/ARM64), Linux/Unix ITM On-Prem agent: Debian 11-13, RHEL/CentOS 7-10, Oracle Linux 7-10, SLES 12/15, Ubuntu 20.04-24.04
- Proofpoint Protection Server (on-prem hardware/virtual appliance), Proofpoint on Demand cloud gateway (extra outbound SMTP hop in front of any MTA), Microsoft 365 (gateway and Graph API), Google Workspace, Microsoft Outlook (Adaptive Email DLP integration; Outlook add-ins for encryption)
- Web Proxy
- Proofpoint Web Security (cloud SWG, Windows/macOS client shared with CASB) - 2021 datasheet, ICAP integration with Zscaler and Citrix ShareFile to Proofpoint DLP service, Browsers for endpoint agent: Chrome, Edge, Firefox (64-bit), Island, Opera, Brave (ZenWeb)
- Cloud Apps
- Microsoft 365, Google Workspace, Salesforce, Box, Okta (IdP connector), ChatGPT/Gemini/Copilot/Claude/DeepSeek/Perplexity (browser extension), 46,000-app shadow IT catalog
- Iaas
- AWS (DSPM in-account scanner; Cloud DLP IaaS API monitoring - separately charged), Microsoft Azure (DSPM; Cloud DLP IaaS), Google Cloud Platform (DSPM), AWS Bedrock, Azure ML, GCP Vertex AI (DSPM AI data governance)
- Databases
- AWS: RDS MySQL/MariaDB/Postgres/MS SQL/Oracle, Aurora MySQL/Postgres, DocumentDB, MemoryDB/Redis, Redshift, DynamoDB, ElastiCache, Keyspaces, Azure: Azure SQL, PostgreSQL, MariaDB, MySQL, Azure Cache, CosmosDB (Mongo, PostgreSQL, Cassandra), GCP: Cloud SQL, Memorystore (Redis, Memcache), Snowflake, Databricks (Unity Catalog), Self-managed: MongoDB, Cassandra, On-prem: MSSQL, MySQL, PostgreSQL, Oracle
- Repositories
- AWS S3, EBS volumes, Azure Blob, Azure File Shares, GCP buckets, SharePoint, OneDrive, Teams (DSPM via AWS/Azure sidecar), Google Drive (DSPM), Salesforce (DSPM), On-prem Windows file shares (DSPM containerized scanner)
Detection technologies
- Smart identifiers and dictionaries - Hundreds of prebuilt data identifiers with algorithmic checks (e.g., credit cards) and dictionaries; custom dictionaries; custom smart IDs built by Proofpoint engineering; proximity/correlation analysis. proofpoint.com
- Built-in classifiers count - More than 240 built-in classifiers (PCI, PII, PHI, GDPR) shared across Cloud DLP and other channels. proofpoint.com
- Exact Data Matching (EDM) - Structured CSV hashed and uploaded to Proofpoint EDM cloud service; tens of millions of rows, 10+ columns; used in email, cloud and web (endpoint EDM URLs present in agent safelist). proofpoint.com
- Indexed Document Matching (IDM) / fingerprinting - Rolling hashes of unstructured documents; 0-100 match percentage; exclusion files; full and partial matching in email. proofpoint.com
- OCR - Text extraction from standalone and embedded images, scanned forms, screenshots, PDFs. proofpoint.com
- AI classifiers (Nexus) - 110+ ready-to-use AI classifiers identifying document categories. proofpoint.com
- Autonomous Custom Classification (ACC) - Uses LLMs to learn organization-specific sensitive content (source code, financial models, engineering docs) without manual tuning; LLM-enriched alerts. proofpoint.com
- Behavioral AI (Adaptive Email DLP / Nexus Relation Graph) - ML on 12+ months email history to detect misdirected email, wrong attachments, exfiltration to personal accounts. proofpoint.com
- File tracking / data lineage - Files downloaded via supported browser are tracked by origin URL across copy/move/rename until egress; File Timeline; cross-channel lineage in Nexus. proofpoint.com
- MIP label detection - Endpoint agent reads/extracts MIP labels (Windows, Mac); Cloud DLP consumes MIP labels; DSPM can apply MIP labels (beta) to SharePoint/OneDrive Office files. docs.public.analyze.proofpoint.com
- Endpoint content scanning channels - Optional agent content-scanning component for Web File Upload, Web File Sync, copy to USB, Web File Download, Document Open, Print, Paste from Clipboard, Copy to Network Drive. Architecture paper states OCR/EDM/IDM were cloud/email only (not endpoint) at time of writing. proofpoint.com
- Email file-type coverage - More than 300 file types scanned out of the box; file-type profiler for custom types. proofpoint.com
Not verified on an official page (not used as fact)
- PPS virtual appliance vCPU/RAM/disk requirements and supported hypervisors - not on public Proofpoint pages (likely behind customer portal).
- PPS / PoD message throughput per appliance model (messages/hour) - not published.
- Mapping of ITM On-Prem DB tiers (Small/Medium/Large/Extra-Large) to exact agent counts beyond the CCU architecture tiers (<=300, 301-3,000, 3,001-10,000 CCU).
- Maximum number of endpoint agents per SaaS tenant or per Agent Realm - not documented (only 'hundreds of thousands of users per tenant').
- DSPM cloud scanner instance types/sizes, autoscaling behavior and typical cloud compute cost per TB scanned.
- DSPM data residency regions (SaaS control plane locations) - not found; on-prem sidecar uses api3.normalyze.io.
- Whether OCR/IDM are now available on the endpoint agent (2024-era architecture paper says cloud/email only; 2026 brief lists Regex/OCR/IDM/EDM for DLP Transform without per-channel split).
- Exact DLP Transform Tier 1 vs Tier 2 vs add-on feature mapping (checkmarks not extractable from PDF).
- Current (2026) availability of Proofpoint Web Security SWG; only a 12/2021 datasheet was found.
- FedRAMP status for ITM/Endpoint DLP, Cloud DLP and DSPM - not found.
- Linux agent DLP prevention feature parity and terminal-server/multi-session support details (SaaS VDI page returned 404).
- Email Protection PoD data center regions/data residency for email DLP.
- Adaptive Email DLP support for Google Workspace / Exchange on-prem - not confirmed on fetched pages (Outlook integration confirmed).