Acronis
DeviceLock DLP

    Stop data leaks at the source with complete endpoint data loss prevention (DLP)

    Contact sales
    Try now
    No credit card required

    Devices access control

    Ensure there’s no leakage of data through local channels by controlling which users or groups can access ports, peripheral, storage, redirected, and mobile devices. Access controls can be enforced depending on the time of day and day of the week.
    Devices access control

    Screen capturing control

    Prevent data theft by blocking screenshot operations via Windows PrintScreen or screen capturing features of third-party apps for certain users or groups. Textual data in captured screen images can be extracted and filtered according to content-aware DLP policies.
    Screen capturing control

    Centralized management and deployment

    Ease the labor-intensive and resource-consuming processes of DLP deployment and managment by choosing from a flexible set of central management consoles with the same UI. Depending on the organization’s IT environment, SMBs or large enterprises can choose the console that best fit their needs.

    Centralized management and deployment
    • Active Directory integration
      Cut learning times and administrative efforts with a console based on the custom Acronis DeviceLock MMC snap-in to the Microsoft Group Policy Management Console used as the Active Directory Group Policy interface. This native integration enables Acronis DeviceLock DLP agents to be deployed and fully managed via Group Policies.
    • Non Active Directory environments
      In non-AD environments, administration is done through Acronis DeviceLock Enterprise Manager, a native Windows app that runs on a separate computer. DLP policies are delivered to all agents (pushed or pulled) via Acronis DeviceLock Enterprise Server (DLES).
    • Directory-less installations
      In such IT environments, e.g. in a Windows for Workgroups network, as well as for managing Acronis DeviceLock Discovery, the custom Acronis DeviceLock MMC snap-in can be used to remotely manage agents on per-endpoint basis.

    Proactive protection

    • Tamper protection
      Universal

      Tamper protection

      Enforce process compliance by preventing tampering with DLP policy settings locally on protected endpoints, even by users with local system administrator privileges. Only designated Acronis DeviceLock DLP administrators can uninstall or upgrade the agent, or modify DLP policies.
    • Printing security
      Universal

      Printing security

      Control network and local printing from Windows endpoints by enforcing DLP policies over user access and content of printed documents for network, local, and virtual printers. Ensure higher data security by intercepting and inspecting print spooling operations, allowlisting of USB-connected printers, and print data shadowing.
    • Network-awareness
      Universal

      Network-awareness

      Administrators can define different online vs. offline DLP policies for the same user or user group. A reasonable and often necessary setting on a mobile user’s laptop, for example, is to disable Wi-Fi when docked to the corporate network and enable it when undocked.

    Allowlisting

    Allow granular controls over data access and transfer operations with the ability to manage exclusions to general DLP rules through wide allowlisting capabilities.

    Allowlisting
    • Core
      USB allowlist
      Allows administrators to authorize a specific model of devices or particular device, distinguished by a unique identifier such as a serial number, to access the USB port, while locking out all other devices.
    • Core
      Media allowlist
      Ease the distribution of authorized software by authorizing the use of specific DVD, BD, and CD-ROM disks, uniquely identified by data signature. Granularly control authorized users and groups that can access them.
    • Core
      Temporary USB allowlist
      For using USB devices on endpoints working out of the corporate network, a temporary access to a USB-connected device can be provided by issuing an access code delivered to the user out of-band, rather than through regular Acronis DeviceLock DLP permissions procedures.

    Increase process compliance

    • Virtual DLP
      Universal

      Virtual DLP

      Prevent data leaks via BYOD devices when using leading remote virtualization solutions. Running on a VDI host or terminal server, Acronis DeviceLock DLP enforces context- and content-aware controls over data exchanges between the virtual workspace and the personal part of the BYOD device, its local peripherals, and the network.
    • Removable media encryption integration
      Core

      Removable media encryption integration

      Increase data security when copying information to removable media by allowing data to only upload to removable storage encrypted by a set of best-of-breed, integrated encryption solutions. Selectively allowlist encrypted USB media to strengthen internal compliance.
    • Alerting
      Universal

      Alerting

      Shorten reaction times with real-time notifications on DLP-sensitive user activities on protected endpoints within and outside the corporate network. Acronis DeviceLock DLP provides SNMP, SYSLOG, and SMTP based alerting capabilities to SIEM systems and administrators.

    Reporting

    To ease information security auditing and compliance reporting and gain deeper visibility into data flows and data protection, Acronis DeviceLock DLP offers a wide choice of reporting capabilities.

    • Graphical reports
      Graphical reports - based on logs.
    • Permissions reports
      Permissions reports - display permissions and audit rules set on all endpoints across the network.
    • Plug-and-play device
      Plug-and-play device reports - display USB, FireWire, and PCMCIA devices currently or historically connected to endpoints in the network.

    Comprehensive log collection for increased visibility

    • Auditing
      Universal

      Auditing

      Track user and file activities for specified device types, ports, and network resources on a computer and collect logs with GMT timestamps centrally in a Microsoft SQL or Postgres database. Pre-filter audit activities by event and context. Audit logs can be exported to many standard file formats for use in other reporting tools.
    • Data shadowing
      Core

      Data shadowing

      Enable security compliance auditing, incident investigations, and cyber forensics by mirroring data transferred without authorization via local and network channels. Leverage data shadowing that’s triggered based on operations context and content. Pre-filter shadow activities for network load balancing.
    • Monitoring
      Universal

      Monitoring

      Monitor remote computers in real-time with Acronis DLES, checking agents’ status, policy consistency, and policy integrity and writing information to the monitoring log. Define a master policy to be applied across selected remote computers in the event that their current DLP policies are out-of-date or damaged.

    Acronis DeviceLock DLP

    72% of employees share sensitive information. Prevent any data leaks headed your way.

    Contact sales Try now

    Resources

    More documents

    Looking for help?

    Frequently asked questions

    • Can Acronis DeviceLock DLP function without internet connection?

      There are two different sets of DLP policies, Regular and Offline, which are automatically applied to a controlled endpoint by Acronis DeviceLock DLP agents depending on its network status. The Offline policy can be triggered by the laptop using either cached or confirmed Windows credential authentication, whether it can connect to any of its known Acronis DeviceLock Enterprise Servers, or if in a wired vs. unwired state.

    • Is Acronis DeviceLock DLP capable of “passive mode” functioning, i.e. not restricting data transfer, but logging and shadow copying?

      Yes, Acronis DeviceLock DLP is capable of functioning in any administrator set mode. We also call this “observation mode”.

      In cases where access to ports, devices, or network protocols is not blocked or content-filtered by policy, logging and data shadowing policy can be actively logging and keeping records in audit and shadow logs in “passive mode”.

      If there is a restrictive access policy active, Acronis’ DLP solution blocks the transfer and prevents data leakage on a controlled endpoint in real time.

    • Is there an option to configure various access control policies for laptops in- and out of the corporate network?

      Yes, there is. Acronis DeviceLock DLP supports various on- and off-corporate-line security policies. This way you can have one policy when the laptop is behind the firewall or DMZ and a totally different policy when the laptop is out in the wild, strengthening DLP security.

      Product help

      In case you have any difficulties, we have collected all the useful materials for this product in our FAQ and Documentation. Also you can always ask your question on our Discussion Boards.

      Technical support

      Customers with active product maintenance or subscription are entitled to 24/7 technical support. Follow the instructions at the Technical Support Site to get prompt support by phone, chat or e-mail.

      Sorry, your browser is not supported.

      It seems that our new website is incompatible with your current browser's version. Don’t worry, this is easily fixed! To view our complete website, simply update your browser now or continue anyway.

      © 2003–2025 Acronis International GmbH. All rights reserved.
      Legal information