Hello @HoangLeH17243233!

While reviewing our content with no replies I came across your question. I'm not sure if you have resolved this on your own or are still looking for assistance.

If you are still looking for assistance, I'd like to direct you to our new Pega As-a-Service Expert Circle that we launched at PegaWorld this year!  Our Expert Circle leaders will be able to assist you over there.

Please repost your question in our Expert Circle or share the resolution here. 

If you repost your question, do let me know and I can make sure our leaders see it!

Thank you!

@HoangLeH17243233

There isn’t one “DLP product” in Pega Cloud; it’s a stack of controls you turn on. Use encryption in transit (TLS) and at rest (platform-managed KMS) for Postgres and S3 repositories, and keep files in S3 with server-side encryption and lifecycle/retention rules. Lock down data access with Access Control Policies (ABAC/RBAC) and enable field-level masking/redaction so sensitive values never render for the wrong user. Turn on log/clipboard obfuscation and scrub sensitive properties from Tracer, logs, and exceptions. For data leaving the platform, use Secure Data Transfer (SFTP with key auth and allowlists) and route all outbound email through your organization’s DLP/secure email gateway (or customer SMTP) to scan content and attachments. Limit downloads to signed URLs, restrict pxDownloadFile usage, and enforce attachment type/size rules. Define purge/archival schedules for cases, attachments, and history to reduce data at rest. Control who can see production data with separate prod-only access groups and masked lower environments. If you need deeper inspection, integrate your enterprise CASB/DLP via API gateways or email gateways while keeping Pega Cloud networking allowlists tight