Opsiton Platform User Guide

Opsiton is a modern, dual-layer endpoint Data Loss Prevention (DLP) platform. It prevents confidential and regulated data from leaving corporate devices — across web browsers, desktop applications, developer IDEs, and command-line terminal tools.

Dual-Layer Architecture

1. 1Central Management: Administrators define and publish security policies from the Tenant Portal
2. 2Native Endpoint Agent: A lightweight native system service (with WFP driver on Windows or Network Extension on macOS) intercepts system traffic and terminal commands
3. 3Browser Extension: Deep DOM and UI interception inside Chrome, Edge, and Brave for instant user warnings and block screens
4. 4On-Device Inspection Engine: Enforces real-time DLP inspection locally on the endpoint with sub-15ms latency
5. 5Real-time Visibility: Sanitized security events and incidents sync to the Opsiton portal for audit and investigation

What Opsiton Detects

• Sensitive text typed into web forms and chat inputs
• Credit card numbers validated via deterministic checksum verification
• National ID (TCKN) and IBAN numbers validated with structural checksum rules
• File uploads inspected by MIME type, extension, and full text extraction (PDF, DOCX)
• Turkish and English OCR extraction from uploaded image files
• Data pasted into 40+ AI services at the network layer, with deep in-browser DOM protection on 6 major GenAI platforms (ChatGPT, Claude, Gemini, Copilot, DeepSeek, Perplexity)
• Visits to malicious, phishing, or unapproved threat URLs
• Terminal commands and desktop application network exfiltration

Opsiton is architected on a strict Zero-Data-Exfiltration model. Your sensitive files, confidential prompts, and private customer records never leave the local endpoint to Opsiton cloud servers.

• On-Device Inspection: All pattern matching, checksum verifications, OCR parsing, and NER-based contextual model evaluations execute 100% locally on the device CPU/GPU
• Sanitized Event Telemetry: When a policy violation occurs, Opsiton transmits only sanitized metadata: rule name, timestamp, domain/application name, severity, and a SHA-256 content hash with masked snippet
• Zero Plaintext Storage: Neither the portal nor Opsiton cloud databases ever receive or store the raw sensitive data.

An IT buyer's primary reliability question is: "What happens if your agent crashes or the daemon stops?" Opsiton operates under a formal fail-safe contract (REQ-PRX-001) that transparently balances non-disruptive business operations against zero data compromise.

Target vs. General Traffic Contract

Enterprise Norm & Empirical Verification

• Industry Standard: Leading enterprise DLP and network security products (Forcepoint "no policies are enforced", GlobalProtect default fail-open) establish that endpoint security must not turn into a single point of operational network failure.
• Empirical Live Verification: Validated on live Chrome and Safari sessions — when the Opsiton daemon is stopped, admin-monitored AI endpoints (chatgpt.com) are instantly dropped (fail-closed) while corporate web tools remain accessible (fail-open).
• Automated IT Visibility: When an agent stops or loses policy synchronization, it reports a degraded status to the central portal and triggers IT diagnostics without disrupting end-user workflows.

Access to the Tenant Portal is governed by role-based access control (RBAC):

Step 1: Register Your Organization

Visit the Opsiton Tenant Portal and click Get Started or Register. Enter your full name, organization name, corporate work email, and secure password.

Step 2: Onboarding Setup

1. 1Create your first DLP policy from verified compliance templates (e.g. Payment Card Checksum, National ID, AI Platform)
2. 2Obtain your fleet Enrollment Token from the Agent Deployment page
3. 3Deploy the Opsiton Agent via MSI/PKG or MDM profiles with Chrome/Edge extension force-installation
4. 4Verify live connection on the Dashboard

The Dashboard provides real-time situational awareness across your entire organization.

Security Posture Score

A dynamic 0-100 score quantifying fleet security health. The score decreases with unaddressed high-severity events and open incidents, and recovers as incidents are investigated and resolved.

Live KPI Cards

Policies dictate what data patterns to detect and what enforcement action to take when an employee interacts with sensitive data.

Enforcement Actions

Built-in Rule Templates

• Payment Cards (deterministic checksum verification)
• TC Kimlik No (11-digit structural verification)
• Türkiye IBAN (international banking checksum validation)
• Turkish Mobile & Landline Phone Numbers
• Email Addresses & Confidential Token Patterns
• GDPR, KVKK, and PCI-DSS Compliance Frameworks

Opsiton features seven specialized detection engines designed for high-accuracy DLP without false positives:

Deploy Opsiton silently across thousands of enterprise workstations using your preferred endpoint management solution (Jamf, Kandji, Microsoft Intune, or Active Directory GPO).

macOS Enterprise MDM Deployment (.mobileconfig & PKG)

Deploy the signed native .pkg installer alongside pre-configured MDM configuration profiles (.mobileconfig) available directly in the Agent Deployment console to eliminate user prompts:

• System Extension Profile: Pre-authorizes Network Extension execution without end-user confirmation prompts
• Content Filter Profile: Authorizes network content filtering for data loss prevention inspection
• Network Proxy Profile: Routes browser and desktop traffic safely through the local Opsiton native service
• Direct Bypass Profile: Configures enterprise direct domain bypass rules for internal and OS infrastructure

macOS & Windows Silent Rollout

Copy your organization-specific silent installation scripts (Jamf/CLI for macOS PKG and Intune/GPO for Windows MSI) paired with your fleet Enrollment Token directly from the Portal > Agent Deployment screen.

Browser Extension Force-Installation (Chrome & Edge)

Ensure the Chrome and Edge extensions are permanently installed and non-removable by pushing the ExtensionInstallForcelist policy via MDM or Active Directory GPO using the policy strings provided in the Agent Deployment console.

To achieve a 100% zero-touch rollout without OS security prompts or conflicts with third-party EDR/AV agents (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint), configure the following MDM payload categories and exclusions using the exact values in your Tenant Portal.

1. macOS Zero-Touch Root CA & MDM Payloads

In silent MDM deployments, the Opsiton installer skips interactive Keychain password prompts so administrators can deploy the local Root CA and system extension approvals via standard Apple MDM payloads:

2. macOS TCC / PPPC Privacy Permissions

Deploy the pre-built Privacy Preferences Policy Control (com.apple.TCC.configuration-profile-policy) profile from the Agent Deployment console to grant Full Disk Access (for local file upload inspection) and Accessibility permissions without user popups.

3. EDR & Antivirus Exclusion Guidelines (macOS & Windows)

Exclude the Opsiton agent installation directories and local inspection service in CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, or Sophos (exact installation paths are listed in the Agent Deployment console) to prevent TLS double-inspection deadlocks and CPU overhead.

To grant security team members access to the Tenant Portal:

1. 1Navigate to Users in the sidebar
2. 2Click the Invite User button
3. 3Enter the corporate email address
4. 4Select the appropriate role: Viewer, User, or Tenant Admin
5. 5Click Send Invite

1. 1Open the automated invitation email received from Opsiton
2. 2Click the secure invitation link
3. 3Set a strong account password
4. 4Sign in with your new credentials
5. 5You will land directly on the Dashboard with your assigned permissions

Opsiton separates operational API keys from device enrollment credentials for defense-in-depth security:

Device Enrollment Tokens (ops_tok_...)

Used exclusively during endpoint agent installation to automatically register devices into your organization without exposing admin API privileges.

Organization API Keys (sk_opsiton_...)

Used for programmatic REST API access, CI/CD pipeline automation, and SIEM / SOAR integrations.

1. 1Go to Settings > API Keys
2. 2Click Create New Key
3. 3Provide a descriptive label
4. 4Copy and securely store the key immediately (it is only displayed once)

sk_opsiton_{org_slug}_{random_secret}

Opsiton delivers maximum endpoint visibility by combining an in-browser companion extension with a native background daemon:

Browser Extension (Chrome, Edge, Brave)

• Real-time DOM inspection: Evaluates text inside input fields, rich-text editors, and textareas before submission
• UI Protection: Renders user-friendly warn dialogs and block screens directly within the browser tab
• Isolated Local IPC: Communicates directly with the local agent daemon in under 1 millisecond

Native Endpoint Daemon (macOS & Windows)

• OS Network Interception: Intercepts desktop apps (Slack, Teams, ChatGPT Desktop, IDEs) and CLI tools (curl, git)
• System Tray: Displays real-time protection health, policy sync status, and pause/maintenance controls
• Hardware Efficiency: Minimal resource footprint consuming less than 1% CPU and under 50MB RAM

The Events page records every policy match across all enrolled endpoints in your organization.

Incidents represent high-priority security cases that require formal investigation, resolution, and compliance documentation.

The Active Users page provides a live inventory of all registered endpoints across your enterprise.

Opsiton monitors 40+ AI providers at the endpoint network layer across Browser, IDE, CLI, and Desktop, while the browser companion extension adds deep in-DOM adapters for six major enterprise GenAI web platforms:

• Deep DOM Web Adapters: OpenAI ChatGPT, Anthropic Claude, Google Gemini, Microsoft Copilot, DeepSeek, and Perplexity (plus 40+ AI providers governed at the OS network layer)
• Prompt Interception: Inspects user prompts before transmission, blocking or masking source code, customer records, or API credentials
• Paste Blocking: Detects clipboard pasting of large confidential codebases or confidential customer data
• File Upload Filtering: Pre-inspects documents attached to AI chat sessions and prevents proprietary document exposure

Data security must not compromise employee productivity. Opsiton is engineered as a compiled native system service for ultra-low latency enforcement.

• Sub-15ms Inspection Overhead: P95 latency overhead introduced by local inspection is under 15 milliseconds
• Transparent Telemetry: The /performance console displays live round-trip latency, upstream TTFB, and pattern/OCR evaluation times
• Zero Impact on Browsing: Local pre-filtering bypasses non-inspected traffic immediately, ensuring full network speed

Connect Opsiton into your existing enterprise notification workflows and enforce strict portal access controls.

Stream sanitized DLP detections, Shadow AI prompts, and threat URL events in real time to your enterprise SIEM, SOAR, or log management platform.

Supported SIEM & Log Destinations

Configuring Event Forwarding in the Tenant Portal

1. 1Navigate to Settings > Notifications & SIEM Webhooks in the Opsiton Tenant Portal
2. 2Select your destination type (Microsoft Sentinel, Splunk HEC, Datadog, or Custom HTTPS Webhook)
3. 3Enter the HTTPS ingestion URL and optional Authorization header or Signing Secret
4. 4Select the minimum severity threshold (Low, Medium, High, Critical) and event categories to stream
5. 5Click Send Test Event to verify connectivity and inspect the HTTP 200 response

Sample Webhook JSON Payload Schema

{
  "event_id": "evt_01J9Z8K4M2N6P8Q1R3S5T7V9W",
  "timestamp": "2026-10-28T09:14:22.418Z",
  "tenant_id": "org_opsiton_eu_central_1",
  "data_residency": "eu-central-1 (Frankfurt, EU)",
  "severity": "critical",
  "action_taken": "masked",
  "policy": {
    "rule_id": "rule_sit_tr_tckn",
    "rule_name": "TR National ID (TCKN Checksum)",
    "category": "CHECKSUM",
    "compliance_pack": ["KVKK_MADDE_12", "GDPR_ART_32"]
  },
  "endpoint": {
    "hostname": "macbook-pro-sec-04.local",
    "os": "macOS 15.1 (arm64)",
    "surface": "Browser (Chrome Extension + Native Agent)",
    "process_name": "Google Chrome"
  },
  "destination": {
    "domain": "chatgpt.com",
    "url": "https://chatgpt.com/backend-api/conversation",
    "ai_provider": "OpenAI ChatGPT"
  },
  "detection_context": {
    "match_count": 2,
    "masked_snippet": "Customer TCKN: *******4812, IBAN: TR**************9012",
    "content_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  }
}

Opsiton ships with 18 Built-in SIT Patterns + 4 Compliance Packs (23 Total Rules) that map directly to technical safeguard requirements across major international regulations:

The following four enterprise enforcement scenarios are continuously verified across macOS and Windows endpoints:

1. Country / TLD-Based Phishing & Malicious Domain Blocking

• Blocks suspicious top-level domains (e.g. *.cn, *.ru, *.top, *.xyz) and newly registered phishing sites at the Browser and OS Network layers
• Combines Threat URL intelligence feeds with custom wildcard domain rules and file upload restrictions
• Technical Distinction: Active agent inspection evaluates and blocks matching wildcard/keyword URLs in real time; if the agent stops, administrator-configured PAC risk domains enforce fail-closed connection drop (REQ-PRX-001)

2. Typosquatting & Homograph Protection

• Real-time detection and warning/blocking of lookalike corporate login domains (e.g. 0psiton.com, rnicrosoft.com)
• Catches Punycode / IDN homograph attacks (xn--*) and character substitution phishing before credentials or files are submitted

3. AI Prompt & File Upload DLP (Shadow AI Governance)

• Applies inline MASK or instant BLOCK when source code, API keys (AWS, GitHub PAT, Stripe), TCKN/SSN/IBAN, or customer tables are pasted or uploaded to ChatGPT, Claude, DeepSeek, Gemini, or Copilot
• Inspects PDF, DOCX, XLSX, and image attachments locally via document parsing and on-device OCR before upload

4. 4-Surface Process-Aware Endpoint Inspection

• Catches non-browser leaks by combining Browser Extension + Native Desktop App + CLI/Terminal (curl, python, claude-code, git) + OS Network Extension (macOS NE / Windows WFP)
• Provides exact process attribution (e.g. curl, python3, Claude Desktop) in security event logs

Opsiton offers straightforward per-agent pricing with no artificial policy or administrator limits. Every plan includes unlimited security policies and unlimited portal users, and the browser extension never consumes a separate seat. Start with a 14-Day Free Trial · Up to 5 Devices · No Credit Card Required.

Free Evaluation & Subscription Lifecycle

The permanent 1-endpoint Free plan includes everything Business detects (OCR, NER, and custom rule patterns), allowing you to evaluate the real product on one real machine with no time limit; multi-device evaluation periods are provisioned on request. Paid subscriptions include a 7-day payment grace window before protection pauses in maintenance mode without data loss.

The Security Score on your Dashboard represents the overall risk health of your fleet on a scale of 0 to 100.

• Incident Impact: Open, unresolved incidents apply a weighted reduction based on severity
• Event Volume: High and Critical severity violations within the last 7 days lower the overall score
• Triage Velocity: Promptly investigating and resolving incidents restores your score back toward 100%
• Fleet Hygiene: Outdated agent or browser versions introduce minor deductions until updated