Overview

Learn about Transfer Shield in Couchdrop

Introduction

Transfer Shield controls files as they move through Couchdrop by scanning transfers and applying Content Rule Groups before files enter or leave your control.

You can use Transfer Shield to detect sensitive content, block transfers, require manual approval, or record matched content for review.

Transfer Shield operates at the transfer boundary:

• Inbound transfers are scanned before files enter your custody.
• Outbound transfers are scanned before files leave your custody.

Transfer Shield only applies to files transferred through Couchdrop. Files uploaded directly into connected storage, such as SharePoint or S3, are not scanned by Transfer Shield.

How Transfer Shield works

Transfer Shield uses Content Rule Groups to define what Couchdrop should detect and what should happen when a file matches.

A Content Rule Group contains one or more Content Rules. These rules can inspect:

• Detected content classifications
• MIME types
• A combination of content classifications and MIME types

When a Content Rule Group matches a transfer, Couchdrop can:

Action	Behavior
Require manual approval	Holds the transfer until an assigned user or group approves or rejects it
Block	Prevents the transfer
Detect only	Records the match and can optionally notify selected users or groups

Only the account owner can create, edit, and assign Content Rule Groups.

For details on configuring groups and rules, see Content Rule Groups and Content Rules.

Where Transfer Shield can be applied

Content Rule Groups can be assigned to different transfer points in Couchdrop, including:

• Globally
• Folders and subfolders
• Upload links
• Mailboxes
• SFTP and FTP users
• Inbound AS2 stations
• Inbound webhooks
• Remote SFTP and FTP destinations
• Outbound AS2
• Storage connections

Global Content Rule Groups apply to both inbound and outbound transfers. They cannot be restricted to only one transfer direction.

Folder-level Content Rule Groups also apply to all subfolders. A subfolder can add stricter Content Rule Groups, but it cannot remove or override groups inherited from a parent folder.

For the full assignment behavior, see Applying Content Rule Groups.

Rule precedence

More than one Content Rule Group can apply to the same transfer.

When this happens, Transfer Shield uses the strictest matching action.

A Block match prevents the transfer even if another Content Rule or Content Rule Group allows it.

Manual approvals

A Content Rule Group can hold a transfer for manual approval.

When this happens:

• An approval task is created on the Tasks page.
• Assigned users or groups can approve or reject the file from the Couchdrop UI.
• Approvals cannot be completed from email.
• Files remain held until they are approved or deleted.

See Manual Approvals for more information.

Activity and auditing

Transfer Shield events are recorded in the existing Couchdrop activity logs.

Transfer Shield activity can include:

• File name
• Source
• Destination
• User or sender
• Matched Content Rule Group
• Timestamp

On Enterprise plans, audit logs are also available through the API. Individual Transfer Shield events can be sent by webhook to a SIEM.

Limitations

Transfer Shield only scans files transferred through Couchdrop.

Files uploaded directly into connected storage outside Couchdrop are not scanned.

Some file contents cannot be scanned:

File type	Behavior
ZIP files	File contents are not scanned
Video files	File contents are not scanned
Encrypted files	File contents are not scanned and are classified as binary data

MIME type classification may still apply when file contents cannot be scanned.

Enabling Transfer Shield

Transfer Shield is available as an add-on and is included with Enterprise plans.

To configure Transfer Shield, navigate to:

Admin Panel > Transfer Shield > Content Rule Groups