The paste
A page of confidential Notion strategy, pasted into a personal AI assistant for a “quick summary.”
Browser DLP · Google Drive, Docs + Notion · pre-pilot
Stop exfiltration at the threshold.
MoonGate evaluates copy, paste, upload, share, and export actions inline in the managed browser and decides locally, on the endpoint, before the action completes. It is a gate in front of the data instead of an alert after the data is gone.
action held at the window capture boundary, before page scripts run
decided locally · no network round-trip
- Manifest V3 extension
- Rust native agent
- Ed25519-signed policy
- Keyed HMAC fingerprints
- Enforces offline from cached policy
- Fail-closed by default
The problem
01
02
03
04
The leak looks like ordinary work.
Sensitive data rarely leaves through malware. It leaves through the browser, one unremarkable action at a time.
The export
A Drive export downloaded to the desktop, then uploaded to personal cloud storage an hour later.
The public link
An external share, guest invite, or public link created on a document that was never meant to leave.
The upload
A protected file dropped into an unapproved site’s file picker, renamed or zipped along the way.
Network DLP can’t see inside TLS. SaaS audit logs report the action after it has completed. The only place a leak can still be stopped is the endpoint where it happens.
The difference
A verdict, not an alert.
Legacy DLP tells you what left. MoonGate decides whether it leaves, synchronously, on the machine.
MoonGate
t = 0User pastes, uploads, or shares
+ the same instantAction held at the capture boundary
+ a local callLocal verdict: allow · audit · warn · block
thenThe action proceeds, or never happens
decided inline on the endpoint · no round-trip to a cloud service
Legacy DLP & audit logs
t = 0Action completes
minutesLogs ship to the SIEM
laterAn alert fires
too lateThe data is already gone
How it decides
Three questions at the gate.
Every intercepted action is evaluated against three things at once. No single answer is trusted on its own.
01
Source
Where is it from?
A protected Google Workspace tenant or Notion workspace? Which document, which label, which classification? Provenance follows content through copies and light edits, and unresolved metadata fails closed to restricted.
02
Content
Is it protected?
Keyed HMAC-SHA-256 fingerprints, exact and shingled, plus file hashes match protected content, including lightly edited excerpts. Raw content is fingerprinted on the endpoint and never persisted or uploaded.
03
Destination
Where is it going?
An approved tenant, an allowlisted domain, or anything else? The agent classifies the destination against signed policy, and a page cannot mark itself approved.
Three answers, one verdict, before the action completes.
ALLOW AUDIT WARN BLOCK
Enforcement
The verdict ledger.
Paste, drop, upload, download, export, share, publish, print: each is held at the boundary and decided. Copy is registered so provenance follows it, and cut and drag from a protected source are blocked outright. Expand a row to see how a verdict is reached.
ActionDestinationVerdict
Paste two pages of a confidential design doc personal AI chat BLOCK
source protected Notion workspace · classification: confidential
content rolling fingerprint match · substantial protected text
destination unknown external origin · not allowlisted
Paste an internal excerpt into personal notes unapproved web app WARN
source protected Drive document · classification: internal
content shingle match · classification internal
destination unapproved · warn and ask for a justification
Create a public link on a board document public link BLOCK
source protected Drive document · classification: restricted
content exact document identity · managed metadata
destination public link · block per policy
Download quarterly financials from Drive local file AUDIT
source protected Drive document · classification: internal
content download control held · hashed where the browser exposes bytes
destination local file on a managed endpoint · audited
Upload a protected file to a vendor portal allowlisted SaaS ALLOW
source protected file · hashed at the upload boundary
content exact SHA-256 hash match against protected content
destination allowlisted corporate service · allowed
Upload that same file to personal storage personal cloud drive BLOCK
source protected file · a rename does not change the hash
content exact SHA-256 hash match against protected content
destination personal account · outside approved boundaries
Illustrative default-policy scenarios. Every real verdict carries its policy version, correlation ID, and match strength, so an investigation can see why the gate opened or closed. File-hash matches need the file to have been registered when it left the browser; text-like files also match by content fingerprint. Files too large to inspect fail closed rather than bypassing evaluation. Native browser-menu print is detect-only today.
Architecture
Context above. Enforcement below.
Cloud signals inform the policy; SaaS audit and EDR ingestion are on the integration roadmap. They never gate the decision, which happens on the endpoint, synchronously, even when the network is gone.
— context, not enforcement —
Google Workspaceaudit events
Notionaudit events
EDR / MDMendpoint telemetry
Control planeEd25519-signed policy ↓
the threshold
Managed browser extension
Manifest V3 · managed policy
- Source & destination context
- Copy · paste · drag · drop
- Upload · download · export
- Share & public-link controls
⟵⟶
native
messaging
messaging
MoonGate endpoint agent
Rust · local & synchronous
- Verified policy cache
- Content fingerprint cache
- Provenance & device identity
- Privacy-bounded event delivery
— enforcement: local, synchronous, fail-closed —
Offline?
The gate holds. Policy is verified, cached, and enforced locally, and an expired cache blocks. Outages are visible on the badge instead of a silent open door.
Unhealthy?
It shows. The toolbar badge is backed by native health checks and a daemon heartbeat, and a managed-policy change holds actions until every tab acknowledges the new configuration. Tamper resistance is not claimed yet; on macOS and Linux the agent can run as a root-owned protected service.
Privacy by architecture
Verdicts travel. Documents never do.
Enforcement that reads everything must be trusted with nothing. Raw content is evaluated on the endpoint and stays there.
What the control plane sees
- decision + reason code
- action + classification
- policy version + correlation ID
- device identifiers
- source / destination origins + tenant IDs
- source document identifiers
- timing + delivery health
What it never sees
- raw document text
- clipboard contents
- file bytes
- content fingerprints
- keystrokes
- centralized copies of your documents
Fingerprints are keyed HMACs, computed and kept on the endpoint. Even a match is reported as a decision, not as content. There is no central corpus of your documents to breach.
Principles
Six commitments.
Each is a design rule the code is checked against.
Prevent first
An inline decision before an upload, paste, download, export, or share proceeds, not a report after.
Preserve provenance
Protected content stays identified by tenant, metadata, labels, hashes, and privacy-preserving fingerprints.
Browser-centric by default
The managed browser is the most reliable first control point for Docs, Drive, and Notion content.
Layer, don’t replace
MoonGate is built to sit beside your EDR, MDM, SIEM, and SaaS audit logs rather than replace them. Those integrations are roadmap, not shipped.
Minimize collection
Only the content identity needed for policy evaluation is retained: local caches and keyed fingerprints, never raw copies.
Fail safely
Cached policy and explicit operational modes make outages observable and intentional, not silently permissive.
Boundaries
What we don’t claim.
Security products earn trust by being precise about their limits. These are ours.
Cameras and screenshots are out of scope. MoonGate does not detect, deter, or watermark screen capture today, and nothing prevents a phone pointed at a screen.
Browser enforcement covers the browser. Native sync clients, CLI and API exports, removable media, and desktop apps need endpoint and SaaS-layer controls. MoonGate is designed to sit beside them, not replace them.
Scripted egress is a separate layer. Page code can move data through asynchronous clipboard and filesystem APIs, direct network requests, and service workers that bypass trusted DOM events; closing those paths takes managed-browser API controls and endpoint enforcement.
It is not a replacement for your EDR, MDM, CASB, or SIEM, and it does not hook or inject into them. Integrations through their APIs are roadmap.
SaaS UIs change. Drive and Notion interception must be re-validated against real UI builds as they evolve; we treat coverage as something to prove, not assume.
Incognito and unmanaged profiles are not covered. Enforcement depends on the managed profile carrying the extension and policy; a private window or a second profile has neither.
Warn is a speed bump. A warn verdict asks for a justification, any non-empty justification allows the action, and the text is not recorded.
Everything else on this page is the enforcement model we build and test against, verified today on synthetic Drive and Notion fixtures.
Early access
Request early access
Early access.
MoonGate is pre-pilot. The managed extension, the Rust endpoint agent, and the signed policy control plane are built and verified against synthetic Drive and Notion fixtures, with a repeatable block-path demo. Since July the agent has gained a daemon heartbeat, a root-owned protected service on macOS and Linux, macOS Keychain custody, and a pattern detector for U.S. Social Security numbers, and a local reverse proxy covers API egress.
We want to talk to a few security teams on Google Workspace and Notion with managed macOS or Windows fleets, who want to shape inline DLP from the first policy onward.
Design partner brief
COHORTdesign partner · early access
SOURCESGoogle Drive, Docs · Notion
ENDPOINTSmanaged macOS · Windows
STAGEpre-pilot foundation
What you get is a conversation about your exfiltration paths and our roadmap.