> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/security-and-governance/transfer-shield-dlp/overview.md). # Overview Learn about Transfer Shield in Couchdrop ## Introduction Transfer Shield controls files as they move through Couchdrop by scanning transfers and applying Content Rule Groups before files enter or leave your control. You can use Transfer Shield to detect sensitive content, block transfers, require manual approval, or record matched content for review. Transfer Shield operates at the transfer boundary: * **Inbound transfers** are scanned before files enter your custody. * **Outbound transfers** are scanned before files leave your custody. Transfer Shield only applies to files transferred through Couchdrop. Files uploaded directly into connected storage, such as SharePoint or S3, are not scanned by Transfer Shield. ## How Transfer Shield works Transfer Shield uses **Content Rule Groups** to define what Couchdrop should detect and what should happen when a file matches. A Content Rule Group contains one or more Content Rules. These rules can inspect: * Detected content classifications * MIME types * A combination of content classifications and MIME types When a Content Rule Group matches a transfer, Couchdrop can: | Action | Behavior | | --------------------------- | ------------------------------------------------------------------------- | | **Require manual approval** | Holds the transfer until an assigned user or group approves or rejects it | | **Block** | Prevents the transfer | | **Detect only** | Records the match and can optionally notify selected users or groups | Only the account owner can create, edit, and assign Content Rule Groups. For details on configuring groups and rules, see [**Content Rule Groups**](/security-and-governance/transfer-shield-dlp/content-rule-groups.md) and [**Content Rules**](/security-and-governance/transfer-shield-dlp/content-rules.md). ## Where Transfer Shield can be applied Content Rule Groups can be assigned to different transfer points in Couchdrop, including: * Globally * Folders and subfolders * Upload links * Mailboxes * SFTP and FTP users * Inbound AS2 stations * Inbound webhooks * Remote SFTP and FTP destinations * Outbound AS2 * Storage connections Global Content Rule Groups apply to both inbound and outbound transfers. They cannot be restricted to only one transfer direction. Folder-level Content Rule Groups also apply to all subfolders. A subfolder can add stricter Content Rule Groups, but it cannot remove or override groups inherited from a parent folder. For the full assignment behavior, see [**Applying Content Rule Groups**](/security-and-governance/transfer-shield-dlp/content-rule-groups.md#applying-content-rule-groups). ## Rule precedence More than one Content Rule Group can apply to the same transfer. When this happens, Transfer Shield uses the strictest matching action. A **Block** match prevents the transfer even if another Content Rule or Content Rule Group allows it. ## Manual approvals A Content Rule Group can hold a transfer for manual approval. When this happens: * An approval task is created on the **Tasks** page. * Assigned users or groups can approve or reject the file from the Couchdrop UI. * Approvals cannot be completed from email. * Files remain held until they are approved or deleted. See [**Manual Approvals**](/security-and-governance/transfer-shield-dlp/manual-approvals.md) for more information. ## Activity and auditing Transfer Shield events are recorded in the existing Couchdrop activity logs. Transfer Shield activity can include: * File name * Source * Destination * User or sender * Matched Content Rule Group * Timestamp On Enterprise plans, audit logs are also available through the API. Individual Transfer Shield events can be sent by webhook to a SIEM. ## Limitations Transfer Shield only scans files transferred through Couchdrop. Files uploaded directly into connected storage outside Couchdrop are not scanned. Some file contents cannot be scanned: | File type | Behavior | | ------------------- | --------------------------------------------------------------- | | **ZIP files** | File contents are not scanned | | **Video files** | File contents are not scanned | | **Encrypted files** | File contents are not scanned and are classified as binary data | MIME type classification may still apply when file contents cannot be scanned. ## Enabling Transfer Shield Transfer Shield is available as an add-on and is included with Enterprise plans. To configure Transfer Shield, navigate to: **Admin Panel > Transfer Shield > Content Rule Groups** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.couchdrop.io/security-and-governance/transfer-shield-dlp/overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.