| 2FA | Two-factor authentication (2FA) requires a user to prove their identity in two different ways before accessing an account. For example, a password used together with a code sent to your phone. |
| 3rd party app | An application developed by a business that is not the same manufacturer as the device on which the app is used. For example, a meeting app such as Zoom used on a mobile phone. |
| 4th party sharing | When an external party to your company shares your files or data with another party that is external to them. |
| Abandoned app | Inactive or dormant shadow app that wasn't used for at least 30 days. |
| About-to-leave employee | An internal user who is leaving the organization at a future date. This date is retrieved from the organization's HRIS (BambooHR, HiBob, Deel HR, SAP SuccessFactors, or Workday) or IdP (Okta, Google Workspace, Microsoft Entra ID (Azure). |
| Access key | A programmable method to define or restrict user access. Generated by an API, an access key can be defined by role or other parameters to ensure that allowed access is situation-specific and legitimate. |
| Actions | DoControl steps you can use when defining your workflows:
|
| Active Directory | A Microsoft application, Active Directory serves as a gatekeeper to ensure users are matched with the correct level of access permissions appropriate for their defined profiles. |
| Actor | A user who triggered the event that generated the alert. Actors can be internal (within your organization) or external (outside your organization). |
| Aggregated alert | A calculated alert that is distributed after a user performs multiple actions, such as sending numerous assets to a personal Gmail account, or publicly sharing large quantities of assets. |
| Aggregated workflow | Consolidates multiple events that occur during a 30-second timeframe into a single workflow execution. Aggregated workflows are based on an event type that is triggered for the same actor. For example: If a user shares 100 files, an event is usually triggered for each file share. An aggregated workflow consolidates all those events into a single event, with one DoControl notification. |
| AI-based search | Ask DoControl any questions related to your Google assets or identities across your organization. DoControl reads your natural language question and translates it to the most relevant area in the DoControl product. DoControl does not share or store customer data with any LLM engine. |
| Alert | Automatic notification that is generated after a triggering event occurs. This event can indicate anomalous user behavior across one of your organization’s SaaS apps. |
| Alert category | Alert grouping based on the event that triggered it. Alert categories include:
|
| Alert ID | Unique alert identifier |
| Alert severity | An indication of how risky the alerted event is. This parameter is fully customizable. Severity levels include:
|
| Alert status | Stage of the alert in the investigation process, such as new, in progress, suppressed, or resolved. |
| Alert-triggered workflow | A workflow that is triggered by a specific alert in order to close the remediation loop faster and ensure better risk coverage. |
| Alert type | DoControl offers several configurable alert types, where each one supports a specific use case across various SaaS apps. Examples include:
|
| API | DoControl exposes an application programming interface (API) enabling you to interact and retrieve data from your integrated apps programmatically. The API is based on the GraphQL query language. |
| App risk | Score from 1-10 that evaluates how risky the shadow app is in your organization (1 - least risky, 10 - most risky). |
| Assessment report | DoControl sends you a summarized report of all your affected assets before remediating them. This report is critical when your assets have inherited permissions from Google shared drives. |
| Asset | File or recording on your organization's SaaS platform. |
| Asset exposure | The extent which a file in your organization is exposed externally or publicly or internally via sharing. |
| Asset monitoring and isolation | Specific assets such as financial and HR documents contain highly-sensitive company information, and consequently, could be potentially targeted. By identifying these assets within your SaaS ecosystem, you can easily track their digital footprint and if necessary, isolate them from excessive exposure. |
| Asset sensitivity | DoControl proprietary ranking that indicates potential asset sensitivity based on the asset name. |
| Audit log | A detailed, chronological record of who did what, when they did it, and from where, creating a complete and visible trail of administrative actions across your platform for the last 12 months. Note that audit log data is available from the date of the feature release (23 July 2025) onward. |
| Benchmarking | DoControl compares the behavior of internal users to their department and the entire organization, while taking the user’s role into account. The department behavior is used as a baseline when considering the contribution of each risk element to the user’s total risk score. |
| Bulk remediation | Mitigate current overexposure by remediating multiple assets in Google Drive (up to 100,000 permissions), Box (up to 50,000 permissions), and Google Workspace (up to 10,000 apps or user tokens). You can apply these inventory actions in bulk across multiple pages of filtered assets:
|
| Burst download | When a user downloads an anomalous number of assets over a short timespan. A burst download can be configured according to these parameters:
|
| CASB | A cloud access security broker (CASB) is a service that is positioned between cloud services users, providers, and devices. It aims to enforce security measures based on a set of policies. Due to the way it operates, a CASB cannot offer comprehensive cybersecurity measures for more complex third party applications. |
| Calculated alert | An alert that is processed after multiple events occur, as in the case of aggregated alerts. |
| CIS-compliant | A major industry compliance standard, the Center for Internet Security (CIS) stipulates controls and recommendations for organizations to implement across their SaaS apps. Being compliant is a basic prerequisite for organizations to do business. |
| Collaborator domain | Assets can be shared with collaborators belonging to:
|
| Content scan | DoControl scans on-demand content in:
An example of a content scan is a list of keywords containing financial details, or a GDPR request with names or emails to be forgotten. Scanned data is not persistent, and DoControl doesn’t store any data. |
| Condition | A subset of an event that triggers a workflow. A condition can include an input value, a comparator, and an input value to check against. |
| Connector | A communication facilitator between DoControl and different apps in your organization. Setting up a connector enables you to send DoControl notifications downstream to other apps. |
| CSPM | Cloud security posture management (CSPM) focuses on securing the posture management of the assets and resources that comprise cloud infrastructure. |
| Data breach | A data breach occurs when a cyber intruder penetrates the security system of an organization and accesses sensitive information. |
| Data classifier | A term that categorizes data based on sensitivity, type, or regulatory requirements. With classifiers, you can proactively identify and protect your personal, financial, health or proprietary data from exposure. |
| Data scan | Scan your assets for data classifiers or regex patterns. You can scan files in Google Drive and Slack, or files and messages in Slack Enterprise. |
| Decide | A workflow action step that sends a message to the approver, asking to either approve or reject the user's action (approval step), or decide between several options (decision step). The workflow branches out according to the approver's decision. |
| DevSecOps | An approach that integrates security from the beginning of the development cycle, in order to create rapid, agile workflows that shorten the development cycle while yielding high-quality software. |
| DLP | Data loss prevention (DLP) includes processes, policies, and software to keep data safe from unauthorized access, destruction, and theft. It also applies to preventing employees from sharing sensitive content outside the organization network. |
| DoControl API action | A dedicated utility action step in automated workflows, the DoControl API step allows you to programmatically access DoControl's functionality without interacting with the user interface. Use cases include:
|
| DoControl bot | End users in public Slack channels can get DoControl bot messages as part of workflows, for example, asking to approve or reject their actions. |
| Domain | A network of computers and devices that are controlled by one set authority, and labeled with a domain name. DoControl categorizes these domain types:
|
| Email template | DoControl’s default email format can be customized with your company brand, and used in workflows for all Approval, Decision, and Notify email actions. |
| Employment status | You can filter internal users according to HiBob and Workday employment status (Active, Inactive, Terminated, Other) or Google Workspace status (Active, Suspended, Archived, Deleted) |
| Encryption key file | A file extension that indicates a file has been encrypted. DoControl provides a lexical list with encryption key file suffixes. This lexical list can be customized and leveraged in workflows to detect and prevent encryption key sharing. |
| Event | A real-time user action in an integrated SaaS app. User actions include creating, viewing, editing, downloading, uploading, sharing a file, and more. An event can trigger a specific DoControl alert, or a defined workflow. |
| Event-based workflow | A workflow that's triggered by a single event in a specific SaaS app. |
| Explicit permissions | Access permissions that are applied directly to the Google Drive file or folder. |
| External collaborator | A user outside the organization who has access to a company asset. DoControl can remove the sharing permissions of external collaborators from an asset, without affecting the access of internal collaborators or asset owners. |
| External connection | A Slack channel with external users outside your organization (also known as Slack Connect). With DoControl, you can choose to monitor all external connections, or exclude some channels. |
| External domain | A domain with external users who have access to assets in your organization. |
| External user | A user outside your organization with access to company assets, such as Google Drive files. |
| Flow control | A workflow action step that controls the execution flow based on input from conditional actions, and creates different paths in your workflow:
|
| GDPR | General Data Protection Regulation (GDPR) is a set of governing rules in Europe that enables consumers to control their personal information. It prescribes specific guidelines for how businesses can handle consumer data, and includes severe fines for organizations that don’t comply. |
| Global search | Clicking Ctrl + K (Windows) or ⌘ + K (Mac) allows you to search for risky use cases across your organization, as well as specific users, assets, workflows and shadow apps. |
| Google inventory shortcuts | Used by many organizations in Google Drives, shortcuts are My Drive links to a shared folder. DoControl distinguishes between shortcuts and shared drive assets, so you can filter out shortcuts. |
| Google labels | Tags that allow your company to organize, find and apply policies to Google Drive files, especially if the content is sensitive or classified. DoControl leverages Google labels with HR and IdP (identity provider) metadata to boost your Google Drive data security beyond its standard capabilities. You can leverage labels in these areas:
|
| Group | A set of internal or external users either imported from your organization’s integrated SaaS apps, or created in DoControl. |
| Historic alert | Alert for Google Workspace event that occurred 6 months prior to your integration date. |
| Historical last view date | If you're a new customer, you can see who last viewed your Google assets from 6 months prior to integrating with DoControl. This capability is unique to DoControl, and not available in Google Workspace. |
| HR groups | DoControl automatically generates groups for all your HR integrations (BambooHR, HiBob, Deel HR, SAP SuccessFactors and Workday) that can be leveraged to remediate file sharing with terminated employees and employee personal emails:
|
| HRIS get user metadata | A workflow step that retrieves metadata of users from HRIS platforms that are integrated with DoControl, such as HiBob, Deel HR, SAP SuccessFactors and Workday. User metadata can include the name and email of the employee's manager, the employee's group, and employment status. |
| Identities | DoControl’s ITDR solution that enables you to discover and monitor your riskiest internal users to protect your organization from identity threats, data breaches and unauthorized access. |
| IdP | An identity provider (IdP) is an entity that manages user identities and issues credentials. |
| Inherited permissions | Access permissions in Google shared drive files or folders that are inherited from their parent folders. To remediate assets with inherited permissions, you must also remediate the parent folders and all child assets, which are outside your original filtered scope. |
| Integration | DoControl integrates with a variety of SaaS apps, enabling you to monitor user activity, get notified about anomalous behavior, and prevent leakage of sensitive data from your organization |
| Internal collaborator sharing | Excess permission privileges were granted to cross-team users within your organization. This significantly increases the volume of sensitive data vulnerable to exfiltration. |
| Internal user | An end user who belongs to your organization, operates within your organization's domains, and has access to company assets. |
| Inventory | Your organization’s asset types and user activity across your SaaS estate. DoControl has full visibility of your SaaS inventory, including users, OAuth apps, shadow apps, assets, groups, domains and IPs, and their metadata. |
| Inventory action | On-demand remediation action that allows DoControl users to manually remediate your SaaS app inventory outside a workflow. You can also apply inventory actions in bulk to multiple assets. |
| IP access restriction | When DoControl users access the platform, their user credentials are authenticated against allowed IP addresses. Users who try to access DoControl from a non-recognized IP address cannot login. |
| IP address | DoControl provides risk context for IPs, providers, and countries where app servers operate from. DoControl checks the validity of an IP address via the VirusTotal threat intelligence platform (TIP), and indicates its risk level accordingly. |
| Lexical list | DoControl provides several out-of-the-box keyword lists for scanning. These lists are customizable, and can be included or excluded when defining workflows.
|
| Malware propagation prevention | Assets shared with or by a suspicious or malicious domain. DoControl generates alerts for these anomalies. |
| MFA | Multi-factor authentication (MFA) requires at least two layers of proof of identity to ensure appropriate access for customers seeking data or use of applications. |
| Malicious domain | A domain that was created for the purpose of promoting scams, phishing, spam, attacks, and frauds. By sharing assets with an infected URL, your organization's data could be exposed to ransomware, viruses, trojans, or other types of malware that compromise your network. DoControl leverages VirusTotal to determine whether a domain is malicious or not. |
| MITRE ATT&CK | A model which describes an adversary’s actions to compromise and operate within an enterprise network. Each DoControl alert is mapped to a specific MITRE ATT&CK tactic and technique. |
| Non-trusted domain | A domains that's not included in your list of trusted domains. DoControl allows you to identify and remediate access for any assets shared with non-trusted domains. |
| Notify | A workflow action step that informs a user or group of users about an event via one of these channels: email, Slack or webhook. |
| OAuth | The Open Authorization (OAuth) protocol enables application-to- application connectivity in SaaS environments, for example, logging into a website using your Google account. If the tokens involved in the authentication process become compromised, the risk of a supply-chain based attack increases significantly. |
| On-demand action | Inventory action that allows DoControl users to manually remediate your SaaS app inventory outside a workflow. You can also apply inventory actions in bulk to multiple assets. |
| Org-wide sharing | Google Drive assets that have the "Company" wide access permission, enabling anyone in the company to access the asset. |
| Organization unit | A subdivision within an organization that can be used to manage and apply settings to a specific group of users or resources. It allows for targeted monitoring and remediation of assets, such as events and files owned by users within that unit. The organizational unit is defined using the org unit path in Google Workspace. |
| Personal account sharing | When employees share data with their own personal email accounts, this opens the door to data exfiltration and increased risk of account takeover attacks, during and even after employees have left the company. |
| Personal email | An employee’s personal email, that usually originates from a free email account, such as Gmail or Yahoo. Personal sharing occurs when employees give themselves access to organizational assets and data through their personal email accounts. This opens the door to exfiltration during and even after their employment. |
| PII | Personally identifiable information (PII) is any information associated with a person’s identity and can be used to profile an individual. Examples include name, address, email address, and cell phone number. Cyber attackers seek this type of data in data breaches in order to steal identities or sell the information on the dark web. By defining DoControl workflows to scan for PII, you can prevent sharing of such information. |
| PII scan | A workflow query action, a PII scan detects the probability that a file includes predefined labels,, such as credit card details and social insurance numbers. |
| Playbook | A predefined template that helps you create a workflow. Playbooks are displayed in categories according to event type, such as encryption key sharing and external collaborator sharing. |
| Posture | Provides a birds-eye-view of the main exposures and security risks in your organization, so you can better understand your security posture over time, as well as trends and immediate actions required to remediate potential data loss.
|
| Private account sharing | When employees or third-party collaborators share data through personal email accounts, such as gmail or yahoo, which don't have the same level of security as company accounts. This opens the door to data exfiltration and increased risk of account takeover attacks, during and even after employees have left the company. |
| Private email | An unauthorized, non-business contact that usually originates from a free email account, such as gmail or yahoo, and could be an attempt to exfiltrate data. These email platforms as a rule do not require multi-factor authentication (MFA), which makes them the weak link in any chain of enterprise security solutions. |
| Private email domain | A non-corporate email domain. DoControl provides a lexical list with private email domains. This lexical list can be customized and leveraged in workflows or alerts. |
| Public channel | A Slack channel which contains internal users only, but anyone can join (as opposed to private channels which can only be joined by invitation). |
| Public domain | A domain that's shared with everyone, and carries the highest risk of potential data exposure. |
| Public sharing | Company assets that are accessible to anyone on the web, where permissions are set to “anyone with the link” can view, edit or share. |
| Query | A workflow action step that investigates the contents of inventory items, such as users, assets, groups or domains. DoControl can run these query actions:
|
| Ransomware encryption file | A common ransomware file extension. DoControl provides a lexical list with ransomware file suffixes. This lexical list can be customized and leveraged in workflows. |
| Real-time alert | An alert that is distributed immediately after an event occurs. |
| Regex scan | Regex (regular expression) is a string or pattern sequence of symbols and characters that is searched for in documents. With the Regex scan query action, you can find customized patterns that are specific to your organization, such as customer data and sensitive company information. |
| Remediation | A DoControl method to prevent unnecessary or potentially damaging data exposure via automated workflows or inventory actions. Remediation actions are specific for each SaaS app and include, for example:
|
| Risk | The potential damage or data loss that might occur as a result of the triggered event. |
| Risk and ROI report | DoControl’s executive report based on end-user activity events and asset metadata across all your SaaS applications from a selected time period over the last year. The report allows you to focus on the main vulnerabilities and security risks in your organization. |
| Risk bracket | DoControl classifies identities according to their risk score:
|
| Risk snapshot | A shadow app risk profile, based on marketplace data, permissions and scopes, and risk elements. The risk snapshot helps you decide whether to allow an app to operate in your organization or not. |
| Risk trend | Change in user's risk score or department risk score over the last 30 days |
| Role-based access control (RBAC) | You can define 3 types of users who can access the DoControl platform, based on role-based access permissions:
|
| SaaS | Software as a service (SaaS) is a usage model where software is hosted in the cloud by a third party and accessed on demand via subscription. |
| SAML | Security assertion markup language (SAML) is a standardized way to authenticate a user's identity for external applications and services. When logging into DoControl, you can choose any identity provider that supports SAML 2.0. |
| Sample event | A synthetic event that wasn't yet received from your integrated SaaS apps. You can create, define and implement security workflows without having to wait for real events to arrive. |
| Scheduled workflow | A workflow that's triggered by a future date (every day, week, month or year) so you can run recurring tasks automatically. |
| SecOps | A collaborative approach that combines security and IT teams to eliminate silos and fortify cross-functional workflows, resulting in more secure platforms and computing environments. |
| Secret | An API key that’s stored with AWS Key Management Service (KMS). You can create secret keys to safely use in HTTP action workflows. |
| Sensitive assets | A file is considered sensitive if DoControl's proprietary sensitivity model assigns a high score to the file name, or a user-defined keyword from the sensitive lexical list was detected in the file name. |
| Sensitive data | Classified or confidential information, including PII, that must be protected to mitigate damage to companies or individuals. With the recent rise in data breaches, government regulations mandate that companies are accountable for safeguarding sensitive data. |
| Sensitive keyword list | A set of words indicating PII (personally identifiable information) or company proprietary information. This lexical list can be customized and leveraged in workflows and alerts. |
| Sensitivity tagging | Google and Slack assets are tagged with a proprietary sensitivity ranking according to the asset name, from the least sensitive to the most sensitive. This property gives context to better understand your asset exposure and risk, and easily mitigate it using DoControl's bulk remediation. |
| Shadow app | Non-human third-party application, device, and other technology that is deployed without the knowledge or authorization of the IT team. DoControl’s Shadow App module performs discovery, control, and automated remediation for shadow app risks. |
| Shadow app classification | DoControl classifies your shadow apps according to these categories:
|
| Sharing status | Indicates the level of exposure of each Google asset, according to Google status:
|
| Slack canvas | A surface in Slack where users can create and share fully-formatted content in Slack Workspace. DoControl monitors Slack canvases, and remediates potential risk by deleting canvases. Slack canvases are listed under Slack inventory > Files. |
| Slack Connect channel | A Slack channel which contains external users (outside your organization). |
| SIEM | A security information and event management (SIEM) solution can display consolidated DoControl alerts and events in its collection board after configuring a connector. |
| SPM misconfigurations | Errors in the setup of an application or service that can lead to security vulnerabilities, such as data breaches, system outages, and compliance violations. |
| SSO | Single sign-on (SSO) allows users to login to multiple applications and services with a single authentication. |
| SSPM | SaaS security posture management (SSPM) is a suite of solutions that automate security for SaaS applications. SSPM discovers, protects, and monitors third-party SaaS applications and platforms. |
| Target | Recipient of an asset. A target can be one of these types:
|
| Trigger | A SaaS event, alert, or inventory action that initiated a workflow into motion. |
| Triggering event | A single SaaS event or multiple events that trigger each alert or workflow in DoControl. |
| Trusted IP | An IP range that indicates a legitimate network. IPs outside this range are considered to be non-trusted. DoControl manages trusted organization IPs in CIDR format. |
| Usage | The shadow app usage indicates much the app is in use relative to the global use of all applications in your organization's SaaS platform. |
| Users | All internal and external individuals who can access, share, and manipulate data stored in your organization’s integrated SaaS apps. |
| Utilities | A workflow action step that sends HTTP requests using API keys to other systems. You can integrate DoControl with popular apps, such as Jira, Datadog, and VirusTotal using predefined HTTP request actions for specific use cases. |
| Wait | A timeout action to be used with a subsequent action in a workflow. For example, when a file is shared with an external user, wait 30 days and then remove sharing. |
| Webhook | Enables you to send real-time notifications to other apps in your organization, whenever a specific event happens as defined in a workflow. Having information in real time is essential to addressing the security and compliance requirements of your organization. |
| Workflow | An automated process that monitors, controls and remediates data access in your SaaS applications, based on your organization's security policies. DoControl workflows are flexible and granular enough to detect almost any malicious or anomalous behavior a user is doing in a specific app. |
| Zero trust | A security policy that assumes any device or user could be malicious and requires proper authentication before allowing access to data or services. |