Data Loss Prevention in Uncountable
Uncountable controls not only how your data is stored, but how it moves: how much can be exported, what protection travels with an exported file, and what is checked on the way in.
For security, IT, and R&D leaders protecting formulation and process IP that is worth more than the platform holding it.
The problem, in one paragraph: Most data loss is not an intruder. It is an authorized user moving more than they should, and the tooling built to stop it usually stops at the perimeter. A scientist with a legitimate login can hold a decade of formulation history, and in most R&D systems there is nothing between that login and a bulk export. Encryption and certifications, which every vendor in this market has, do not touch that. The question a security reviewer actually needs answered is what happens when the credentials are real and the intent is not.
What You Can Do
Cap how much anyone can take. Set limits on the number of experiments and notebook files a user can export in a given period. A bulk export stops being something you discover afterward.
Warn quietly, or block outright. A warning threshold lets the export proceed and notifies administrators without alerting the user, so unusual behavior can be watched rather than tipped off. An error threshold blocks the export where it stands.
Set different limits for different roles. Quota periods and thresholds are configured per user group, so a contractor, a summer intern, and a principal scientist are not governed by the same number.
Send protection out with the file. Uncountable applies your own Microsoft Purview sensitivity labels to data leaving the platform, configurable down to material family or project. Access to that file, including one the platform generated, then follows the provenance of the data inside it, wherever the file goes next.
See who is exporting what. Administrators track notebooks exported and files viewed per user, so a pattern that would otherwise surface in an exit interview surfaces while it still matters.
Check what comes in as well as what goes out. Every uploaded file is scanned before it is accepted, regardless of type, so the platform is not a route for introducing malicious files into your environment.
Why Security Teams Choose It
A compromised account cannot quietly drain the library. One set of stolen credentials gets one user's quota, not the formulation history.
Enforcement does not depend on somebody noticing. The thresholds act at the moment of export. Nothing waits for a log review.
Nothing to deploy on the endpoint. No new agent, no software on the user's device, no change to how scientists work.
Protection that survives the export. Labeling means a file that leaves is still governed by your policy, which is the gap most export controls leave open.
Limits that fit the organization. Group-level configuration means the controls can be tight where they need to be without slowing down the people doing the work.
Built on an already-audited platform. These controls sit on top of SOC 2 Type II and ISO 27001 certification, schema-level tenant isolation, and encryption throughout.
How It Works
1 · Setup. An administrator sets the quota period, the warning threshold, and the error threshold, per user group.
2 · Monitoring. Every export counts against that group's limit for the current quota period, tracked in real time.
3 · Enforcement. At the warning threshold the export proceeds and administrators are notified. At the error threshold the export is blocked and administrators are notified.
The Broader Security Picture
These export and file-level controls sit alongside the credentials and safeguards Uncountable already has in place.
- SOC 2 Type II and ISO 27001. Independently audited, current, and unqualified.
- Encryption everywhere. AES-256 at rest, TLS in transit, and schema-level tenant isolation between customers.
- Resilience. Multi-availability-zone deployment, point-in-time recovery, and a documented disaster recovery plan, with recovery point and recovery time objectives of ten minutes.
- SSO and SCIM. SAML v2 single sign-on with automatic user provisioning and deprovisioning.
- 48-hour breach notification. A committed notification window if an incident occurs.
- Continuous monitoring. Intrusion detection and centralized security monitoring across the environment.
Security by architecture, not by exception.
FAQs
Not if you have set a limit. Export caps are configured per user group and count experiments and notebook files against a quota period you define. Past the warning threshold the export proceeds and administrators are notified. Past the error threshold it is blocked.
No. The warning tier is deliberately silent to the user and visible to administrators, so unusual activity can be monitored rather than tipped off.
If you use Microsoft Purview, your sensitivity labels are applied to the exported data and travel with the file. A correctly configured label can prevent that file from being opened outside your organization. The policy is yours and it is enforced by your Purview configuration, not by Uncountable.
No. There is no agent and no software on the user's device. The controls are part of the platform.
No. Quota period and thresholds are set per user group, so limits can differ by role, seniority, or employment type.
