> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement.md). # Sensitive data movement **SaaS security problem** When personally identifiable information (PII) is shared to publicly accessible locations, such as public Slack channels, or shared with many people, it remains exposed forever. This increases the risk of data breaches and unauthorized access to sensitive information. In the case of terminated employees, organizations sometimes forget to offboard them from all IT systems on their last day, since HR and security platforms are often disconnected, making this process overly complex. Without a centralized view of user activity across all SaaS applications, or the ability to automate any part of the permission-cleanup process, data exfiltration by leaving employees is difficult to prevent, especially for large organizations. As a result, about-to-leave and previous employees can continue to exfiltrate company data by downloading files. **DoControl solution** Once an employee’s status in HR systems has been changed from Employed to About to leave or Terminated, your organization should consider the employee a high security risk. This status change is an opportunity for security and IT teams to monitor the employee’s behavior around the company’s digital assets. The DoControl integration with Google Drive, Zoom, Jira, Salesforce and Slack Enterprise allows your organization to detect and prevent sensitive data, such as personally identifiable information (PII), from being shared on Zoom cloud recordings, in Jira issues or in Slack channels and direct messages. This functionality is unique to DoControl, and essential to data loss prevention (DLP). If PII is detected, DoControl automatically notifies your security team so they can take appropriate action, and delete any sensitive files if necessary. DoControl leverages these tools to provide full visibility, and automatically monitor and remediate sensitive data movement risks across a variety of apps: * [Inventory of users, groups and departments](#inventory-of-users-groups-and-departments) * [Alerts](#alerts-for-sensitive-data-movement) * [Playbooks](#playbooks-for-sensitive-data-movement) ## What's the risk? Any personal information shared to public locations within a company – such as public Slack channels, shared drive folders, or Salesforce opportunities – will remain exposed forever, allowing anyone with high-level internal access to see, download or otherwise use the information. PII scanning tools in traditional data loss prevention (DLP) solutions do not effectively extend to data stored within SaaS applications, so PII shared in these locations must be manually discovered and deleted – an undertaking for which most security teams do not have time or resources. As long as dismissed employees have access to company assets, they can continue to exfiltrate them and even delete them, causing significant damage to an organization. {% hint style="info" %} **Did you know?** A New York-based accounting firm fired an HR executive yet did not immediately revoke her access to all IT systems. Over the course of several days after her termination, the former employee logged into an external HR platform and deleted thousands of files. As inexplicable as this scenario seems, it’s not uncommon, and it can point to a deficiency in the company’s technological capabilities as much as a lack of organization. {% endhint %} ## Inventory of users, groups, and departments When your organization's HRIS is integrated with DoControl, you gain full inventory visibility. You can view: * All users, organizational departments and groups that users belong to. * Employment status (terminated employees and about-to-leave employees). * Other relevant metadata such as title or personal email.

User metadata gleaned from HiBob

#### To view HRIS user data: 1. From the DoControl side menu, click **Inventory** > **Users**. 2. To display all user data for a specific app, select the relevant SaaS app, such as HiBob, from the dropdown menu. {% hint style="info" %} For more information about HRIS users, see [internal users](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-users/hris-users.md). {% endhint %} ## Alerts for sensitive data movement DoControl alerts automatically notify your organization when sensitive data movement occurs: * **Leaving employee** alerts (DC30, DC34, DC35) are triggered for terminated or leaving employees. DoControl detects a terminated employee as someone who was deleted from either BambooHR, Google Workspace, or Microsoft Entra ID. * A **public sharing** alert (DC105) is triggered when unprotected Zoom recordings containing PII are publicly shared. * A **downloading asset** alert (DC33) is triggered when an anomalous number of file downloads occurs over a short period of time; for example, an internal user who is about to leave downloads sensitive assets.
Alert typeDoControl alert nameAlert description
DC105Unprotected sensitive cloud recording is publicThis alert will trigger when an internal user has completed a cloud recording in Zoom that contains potentially sensitive files, is not passcode protected, and can be publicly shared.
A recording is considered sensitive if its name includes one or more sensitive keywords, or a user-defined keyword was detected in the recording name.
DC33File download by about-to-leave employeeThis alert will trigger when an internal user who is about to leave downloads sensitive assets. This alert requires an active integration with an HRIS or IdP (Okta, Google Workspace, Microsoft Entra ID). DoControl defines sensitive assets as those whose file name has a sensitivity score of at least 90%, OR contains a custom keyword from the sensitive keyword lexical list, as defined by the organization.
DC30Possible former employee accessed assetsThis alert will trigger when a possible former employee actively accesses internal assets (via view, edit or download). DoControl detects a terminated employee as someone who was deleted from either BambooHR, Google Workspace, or Microsoft Entra ID.
DC34Possible former employee publicly sharedThis alert will trigger when a possible former employee publicly shares internal assets. DoControl detects an employee who was either terminated or deleted from the HR system, Google Workspace, or Microsoft Entra ID.
DC35Possible former employee externally sharedThis alert will trigger when a possible former employee uses their personal email to externally share internal assets. DoControl detects an employee who was either terminated or deleted from the HR system, Google Workspace, or Microsoft Entra ID.
{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? For **leaving employee** alerts, you can remove external sharing permissions from exposed assets by using the **Remove external collaborator** inventory action. It is also recommended to set up a workflow that will auto-expire sharing with external users and minimize risk over time. You can also deny the actor's access to any asset in Google Drive. {% hint style="info" %} You can apply inventory actions to remove external collaborators from assets in these SaaS apps: * [Box](/docontrol-user-guide/workflows/inventory-actions-quick-actions/box-inventory-actions.md) * [Google Drive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md) * [OneDrive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md) * [SharePoint](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md) {% endhint %} For **public sharing** alerts you can trigger a [workflow](/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/zoom-playbooks-for-sensitive-data-movement.md#notify-on-cloud-recording-without-passcode) to notify security teams when completed Zoom cloud recordings have no passcode protection, and can be publicly shared. This helps to minimize risk over time. ## Playbooks for sensitive data movement To address the use cases of sensitive data movement across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will notify your security team when: * An about-to-leave employee downloads sensitive files in Google Drive * Jira users upload PII (personally identifiable information) in a comment or attachment, or in a new or updated issue. * Users upload files containing PII to a Teams channel. * Zoom users upload a recording containing PII or that's not passcode-protected to the cloud. \ You can also remove a publicly shared sensitive Zoom recording from the cloud.

Select a predefined DoControl playbook to remediate sensitive data movement

Playbook nameSaaS appPlaybook description
Notify on about-to-leave employee downloading sensitive filesGoogle DriveWhen an about-to-leave employee downloads a file containing PII in Google Drive, the Security team is automatically notified by Slack.
Notify on PII in Jira attachmentJiraWhen PII (personally identifiable information) is detected in a Jira attachment, the Security team is notified in Slack.
Notify on PII in Jira commentJiraWhen PII (personally identifiable information) is detected in a Jira comment, the Security team is notified in Slack.
Notify on PII in new Jira issueJiraWhen PII (personally identifiable information) is detected in a new Jira issue, the Security team is notified in Slack.
Notify on PII in updated Jira issueJiraWhen PII (personally identifiable information) is detected in an updated Jira issue, the Security team is notified in Slack.
Remediate PII exposure in new Jira issueJiraWhen PII (personally identifiable information) is detected in a new Jira issue, the Security team is notified in Slack, and the issue or selected comments/attachments are deleted.
Notify on bulk actions in SalesforceSalesforceIf a Salesforce user who is about to be terminated, or they are an integration partner or guest, performs a bulk query action, then the Security team and the user's manager are notified in Slack.
Notify on sensitive report exported by terminated employeeSalesforceIf a Salesforce user, who is about to be terminated, exports a Salesforce report, then inform the Security team and the user in Slack.
Detect sensitive patterns in Slack Enterprise external direct messagesSlack EnterpriseWhen someone sends a message or file as a direct message in an external Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Detect sensitive patterns in Slack Enterprise internal channelsSlack EnterpriseWhen someone sends a message or file in an internal Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Detect sensitive patterns in Slack Enterprise internal direct messagesSlack EnterpriseWhen someone sends a message or file as a direct message in an internal Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Detect sensitive patterns in Slack Enterprise shared channelsSlack EnterpriseWhen someone sends a message or file in a shared Slack Enterprise channel, and the file or message contains sensitive regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Remove PII from Slack Enterprise external direct messagesSlack EnterpriseWhen someone sends a message or file as a direct message in an external Slack Enterprise channel, and the file or message contains PII (personally identifiable information), both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Remove PII from Slack Enterprise internal channelsSlack EnterpriseWhen someone sends a message or file in an internal Slack Enterprise channel, and the file or message contains PII (personally identifiable information), both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Remove PII from Slack Enterprise internal direct channelsSlack EnterpriseWhen someone sends a message or file as a direct message in an internal Slack Enterprise channel, and the file or message contains PII (personally identifiable information), both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted from Slack Enterprise.
Scan Slack Enterprise direct messages for sensitive contentSlack EnterpriseWhen someone sends a message or file as a direct message in an internal Slack Enterprise channel, and the file or message contains data classifiers or regex patterns, both the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored.
Notify on sharing sensitive files via Teams channelTeamsWhen a user shares a sensitive file in Teams, the Security team is automatically notified by email and a Teams webhook.
Remediate sharing of sensitive OneDrive files via private chat in TeamsTeamsWhen a user shares a sensitive OneDrive file in Teams, the Security team is automatically notified by email and a Teams webhook, and any public sharing links are automatically removed.
Notify on cloud recording without passcodeZoomWhen a Zoom recording without a passcode is completed, the Security team is notified in Slack that the recording is not passcode-protected.
Notify on PII in Zoom cloud recordingZoomWhen a Zoom cloud recording contains PII (personally identifiable information), the Security team is notified in Slack, and the entire Zoom recording (or selected entities) are deleted.
Remove public share from Zoom cloud recordingZoomWhen a Zoom cloud recording contains PII (personally identifiable information), the sharing status of the Zoom recording is automatically changed to internal.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.