Control phone and PC transfers in your company

At a glance

• Policies are signed with the administrator’s private key and checked on each device.
• Switch features off, block file types or set a maximum file size.
• Keep resident registration and card numbers out of the clipboard.
• Allow the local network only, with no internet connections.
• A tamper-evident audit log can be required.

Step by step

1. 1

   Create an admin key

   On the administrator’s PC run pdb team init. Keep the key file private.

2. 2

   Write and sign the policy

   Describe the rules in a JSON file and sign it with pdb team sign policy.json --org "Your company", which creates team-policy.json.

3. 3

   Enroll each PC

   On each PC open Settings › Security & organisation › Organisation › Team enrollment, enter the organisation name and the Admin key, and click Enroll.

4. 4

   Apply the policy

   Click Apply policy file… and choose team-policy.json, or run pdb team apply team-policy.json. pdb policy shows what is in force.

5. 5

   Check the audit log

   Open Audit log and use Verify integrity, or run pdb audit --verify, to confirm the record hasn’t been changed.

Clipboard rules

In clipboard_block use kr_rrn (resident registration numbers), card (only valid card numbers are blocked), kr_phone or email, or re: followed by a regular expression for anything else. Look-alike dashes, other digit forms, dots or tabs as separators and invisible characters are handled, and the same rules cover text and links sent to My Drop. Unknown rule names are refused when you sign.

What it isn’t

There are no user accounts, no SSO and no cloud console, by design. The audit log records what each device did in a chain of hashes, so later changes are detectable.

Questions