Overview

What is BlueSentinel and how does it protect your organization from data exfiltration.

What is BlueSentinel?

BlueSentinel is a self-hosted Data Loss Prevention (DLP) platform that blocks data exfiltration through every vector on employee endpoints. It consists of two components:

DLP Agent — A lightweight daemon that runs on Windows and macOS endpoints, enforcing 10 security guards
Central Server — A multi-tenant admin dashboard for managing devices, policies, alerts, and remote commands

Why BlueSentinel?

Most DLP solutions block one or two vectors (USB, maybe email). BlueSentinel covers all of them:

Guard	What It Blocks
USB Guard	Flash drives, external HDDs, SD cards
Network Guard	SSH/SCP, FTP, unauthorized ports
Browser Guard	File uploads, code paste, drag-and-drop
Process Guard	TeamViewer, Telegram, torrents, VPNs
Clipboard Guard	Source code copy-paste, credential theft
Screenshot Guard	Print Screen, screen recording, capture tools
File Watcher	Bulk file operations, sensitive file access
AirDrop/BT Guard	AirDrop, Bluetooth file transfer
Print Guard	Unauthorized printing, print-to-PDF
Encryption Guard	BitLocker/FileVault enforcement

Key Differentiators

Self-hosted — Your data never leaves your infrastructure. Recovery keys, alerts, policies — all on YOUR server.
Multi-tenant — Manage multiple organizations from one server. Perfect for MSPs and IT service providers.
Anti-tamper — Dual watchdog processes, self-healing, file locking. Users cannot stop or uninstall the agent.
Offline-capable — Agent queues alerts locally and enforces last-known policy when the server is unreachable.
Zero per-device cost — No recurring license fee per endpoint. Pay for the plan, not the seat count.

Architecture

┌─────────────────────┐          HTTPS/TLS          ┌──────────────────┐
│   Central Server    │◄────────────────────────────►│   DLP Agent      │
│   (Flask + PostgreSQL) │                           │   (Python daemon) │
│                     │    Heartbeat (60s)           │                  │
│   - Admin Dashboard │    Policy Push               │   - 10 Guards    │
│   - REST API        │    Alert Stream              │   - Anti-Tamper  │
│   - Policy Engine   │    Remote Commands           │   - OS Enforcer  │
│   - Alert Store     │                              │   - Offline Queue│
└─────────────────────┘                              └──────────────────┘
        Port 5100                                     Runs as root/admin

Supported Platforms

Windows 10 / 11 — Full agent with all 10 guards
macOS 12+ (Monterey and later) — Full agent with all 10 guards
Chrome Extension — Force-installed browser protection (domain blocking, upload prevention, paste detection)

Next Steps

Quick Start Guide — Get up and running in 30 minutes
System Requirements — Hardware and software prerequisites
Architecture — Deep dive into the system design