Clipboard Protection
What is Clipboard Protection?
Clipboard Protection is a Data Loss Prevention (DLP) capability in FenixPyre that monitors clipboard activity and controls how content from FenixPyre encrypted files is cut, copied, and pasted. It distinguishes between copy and paste operations and enforces policies that stop sensitive encrypted content from being moved into unauthorized processes or applications.
Clipboard Protection is part of FenixPyre's DLP suite, alongside Print Protection, Screenshot Protection, and Dynamic Watermark Display.
What Problem Does Clipboard Protection Solve?
Copy-and-paste is one of the easiest ways for sensitive information to leak out of a protected file and into an unprotected one. Earlier behaviour blocked all copy-and-paste operations on the device whenever an encrypted file was open, which was disruptive to everyday work.
Clipboard Protection replaces this all-or-nothing approach with granular control. It allows normal clipboard use while specifically preventing content that originates from a FenixPyre encrypted file from being pasted into an unencrypted destination.
How Does It Work?
Clipboard Protection provides real-time clipboard monitoring and policy enforcement over cut, copy, paste, and Paste Special actions:
Detects copy operations from sensitive (encrypted) sources.
Detects paste operations into target applications.
Prevents sensitive content from being pasted into unauthorized or untrusted applications.
When the copied content does not originate from a FenixPyre encrypted file, users can paste it into any destination.
Displays an on-screen indicator in the bottom-right corner of the screen when Clipboard Protection is enabled.
Decision Matrix
The following matrix summarizes how clipboard actions are evaluated:
FenixPyre Encrypted File
Same file
Allow
FenixPyre Encrypted File
FenixPyre Encrypted File
Allow
Unencrypted File
Any File (Encrypted/Unencrypted)
Allow
FenixPyre Encrypted File
Unencrypted File
Deny
FenixPyre Encrypted File
Unencrypted Destinations like ChatGPT, Claude, Gemini, Microsoft Teams, Outlook Email etc
Deny
Clipboard Protection is enabled together with Screenshot Protection and Print Protection. When an administrator enables the Clipboard Protection Service in the user policy, all three protections are activated together.
Configurations
Clipboard Protection uses the following Windows registry values.
Registry path: HKEY_LOCAL_MACHINE\Software\FenixPyre\Parameters
All settings use the REG_MULTI_SZ type.
FPDlpBlockedProcesses
Blocks any paste into these processes.
OUTLOOK.EXE, MS-TEAMS.EXE, MSEDGEWEBVIEW2.EXE, CHROME.EXE, MSEDGE.EXE, FIREFOX.EXE
FPDlpCriticalProcesses
Does not enforce Clipboard Protection for these critical processes.
SYSTEM, IDLE, CSRSS.EXE, WININIT.EXE, SERVICES.EXE, LSASS.EXE, MMC.EXE, SMSS.EXE, EXPLORER.EXE, WINLOGON.EXE, SPOOLSV.EXE, SVCHOST.EXE, LSM.EXE, DWM.EXE, FONTDRVHOST.EXE, AUDIODG.EXE, MSMPENG.EXE
FPDlpIgnoredExtensions
Does not enforce Clipboard Protection for these system file extensions.
api, dat, ini
FPDlpMonitoredProcesses
Enforces Clipboard Protection for these processes.
WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, ACRORD32.EXE, ACROBAT.EXE, ACAD.EXE, REVIT.EXE, CODE.EXE, NOTEPAD.EXE, NOTEPAD++.EXE, WORDPAD.EXE, REVU.EXE, REVU32.EXE, DWGVIEWR.EXE, INVENTOR.EXE
FPDlpUnmonitoredAppsFolders
Does not enforce Clipboard Protection for files in these folders.
\.vs\, \.vscode\, \.vscode-shared\, \.git\, \.dotnet\, \.cache\, \.nuget\, \.ssh\, \.templateengine\, \.osquery\, \.ms-ad\, \node_modules\
After changing these registry values, restart the FenixPyre services.
The changes take effect only after the restart.
Limitations
Clipboard clearance in unsaved Microsoft Word documents: When content is copied from an encrypted Word (
winword.exe) document to a newly created, unsaved Word document (for example, Document1, Document2), the application's internal architecture bypasses external API hooks and may permit the paste. To mitigate this, the agent automatically clears the system clipboard upon detecting a focus change or paste attempt into an unsaved Word document. As a result, no copied content - encrypted or unencrypted - can be pasted into a newly created, unsaved Word file. Workaround: Save and name the destination document first; once it is saved to a valid path, re-copy the content from the source and paste it normally.Third-party application compatibility: DLP enforcement depends on how each application natively handles system APIs and clipboard operations. Applications that use custom UI frameworks or proprietary rendering engines, and some web browsers or localized application sandboxes that manage the clipboard internally, may bypass standard Win32 API calls and cause inconsistent enforcement.
Learn how to configure this from the clipboard protection settings on admin dashboard.
For more information on how to enable and configure Clipboard Protection, please contact FenixPyre Support.
Last updated
Was this helpful?