Claude Compliance API

Strac detects and redacts PHI, PII, PCI, and secrets across Claude — chat, MCP, and Compliance API.

Book a Demo

Table of Contents

Summarize and analyze this article with:

Strac integrates with the Claude Compliance API

Strac integrates with the Claude Compliance API to help enterprise security teams see and govern how Claude is used across the organization. Strac ingests your organization's Claude Compliance API activity feed and turns it into an audit-ready risk dashboard — total activity, distinct users, chat and file activity, and a complete who-did-what record — and applies its content-level classification engine, the same one behind Strac's browser and MCP DLP, to detect PHI, PII, PCI, secrets, and credentials in Claude activity.

What Strac Monitors Through the Claude Compliance API

Once connected, Strac continuously ingests the compliance data the Claude Compliance API makes available and surfaces it as a governed risk dashboard:

Claude activity at a glance — total audit events, distinct users, chat activity, and file activity, broken down by activity type and resource (chats, files, projects).
A complete audit trail — who did what, when: file views and uploads, chats created, viewed, and deleted, project access, SSO logins, admin and configuration changes, and API key creation.
A governed risk view — Overview plus Risks by Activity, Owner, and Resource Type, for audit-ready visibility into Claude usage.
Sensitive-data content classification — PHI, PII, PCI, secrets, and credentials detection across Claude conversation content, on the same engine behind Strac's DLP.

✨ Beyond Visibility: Strac Redacts Sensitive Data Before It Reaches Claude

The Claude Compliance API gives you visibility into Claude activity. Strac pairs that with prevention — the same detection engine, applied the moment data is about to reach Claude, across two more surfaces:

Browser DLP for Claude — Strac's browser extension inspects prompts in Claude at claude.ai and redacts, masks, or blocks PHI, PII, PCI, and secrets in real time, before they reach the model.

Strac browser DLP redacting PII, PHI, and PCI inline in a Claude conversation before it reaches the model — Strac's browser DLP tokenizes sensitive data inside a Claude conversation before the model ever sees it.

MCP DLP for Claude connectors — when Claude reaches Slack, Google Workspace, databases, and more through the Model Context Protocol, Strac inspects every tool call and redacts sensitive data in both directions, before it enters Claude's context.

Strac MCP DLP redaction flow — PII, PHI, PCI, and secrets redacted in every MCP tool call before the data reaches Claude — Strac redacts PII, PHI, PCI, and secrets in every MCP tool call before the data reaches Claude.

Together, the Claude Compliance API integration (visibility) and Strac's browser and MCP DLP (prevention) give enterprises end-to-end data protection for Claude. See Claude DLP, MCP DLP, and Is Claude HIPAA compliant?

Why Security and Compliance Teams Use It

The Claude Compliance API gives security teams a feed of Claude activity; Strac turns that feed into governed, audit-ready evidence — and adds the redaction layer that keeps regulated data out of Claude in the first place. Instead of guessing how Claude is being used across the org, you get a clear record of who did what, when, and continuous detection of sensitive data across Claude.

Trusted by enterprises
Discover & Remediate PII, PCI, PHI, Sensitive Data

Book a Demo

Sharepoint DLP Use Cases

Practical Scenario

A hospital’s billing and administrative teams use SharePoint Online to store patient invoices, medical reports, and insurance forms. While collaborating with external insurance providers, a staff member accidentally updates the permissions on a SharePoint document library to “Anyone with the link,” exposing potentially thousands of patient files containing PHI.

How Strac's Sharepoint DLP Helps

Continuous Data Discovery: Strac automatically scans existing and newly uploaded documents, identifying PHI (e.g., medical record numbers, Social Security Numbers).
Classification & Labeling: Once identified, files are labeled (e.g., “HIPAA Sensitive”), ensuring that administrators know which documents require the highest level of protection.
Visibility into Access: Strac provides real-time insight into who has access to these sensitive documents. Administrators can instantly see if unauthorized users or broad groups have viewing rights.
Revoke Public Links: If a file is publicly accessible, Strac immediately revokes those links and restores restricted access.
Alerts & Quarantines: When someone attempts to share PHI externally, Strac can alert admins, quarantine the file for review, or completely block the action.
Audit-Ready Reports: All actions are logged, enabling quick incident response and demonstrating HIPAA compliance for audits.

Practical Scenario

A mid-sized investment firm uses SharePoint to collaborate on various client files, including:

Credit card statements (subject to PCI-DSS)
ID documents (Driver’s Licenses, Passports, etc.) used for KYC (Know Your Customer) verification
Banking information such as account and routing numbers

An associate accidentally shares a SharePoint folder containing these files with a newly onboarded client who does not require access to all confidential documents. This folder is also accessible to several internal teams outside the immediate project, creating multiple potential exposure points.

How Strac's Sharepoint DLP Helps

Comprehensive Data Discovery: Strac scans both existing and newly uploaded documents in SharePoint for sensitive information such as credit card numbers, bank account details, and ID documents (Driver’s License, Passport formats).
Classification & Automated Labeling: Once identified, Strac applies meaningful labels (e.g., “PCI-DSS Sensitive,” “PII – ID Documents,” “Banking Info”) to ensure these files stand out and are subject to stricter security rules.
Visibility into Access: Strac provides an immediate view of who currently has access to these sensitive files. This allows admins to spot situations where external clients or internal teams unnecessarily have permissions.
Public Access Revocation: If a labeled document (e.g., containing card data or ID scans) is found to be publicly shared or too broadly accessible, Strac automatically revokes these links or permissions, aligning access with the principle of least privilege.
Alerts, Quarantines, and Blocks: When a user attempts to share a labeled document with outside domains—or with an entire department—Strac alerts administrators or quarantines/blocks the file share, depending on policy settings.
In cases where the share is intentional but needs review, admins can approve or deny the request within Strac’s dashboard.
Audit & Compliance: Every sharing event, label assignment, and access revocation is logged, creating a detailed audit trail. This helps demonstrate compliance with PCI-DSS, KYC, AML, and other regulatory requirements.
Automatic reporting simplifies any regulatory or internal compliance audit, reducing the administrative burden on security and compliance teams.

Practical Scenario

A software company keeps source code, product roadmaps, and design specs in SharePoint. Several teams—including external contractors—use the same SharePoint site. A developer accidentally grants a large group, including some non-disclosure–exempt contractors, access to a folder containing patent-pending code.

How Strac's Sharepoint DLP Helps

Holistic File Scanning: Strac inspects documents, PDFs, and archives for code snippets, system designs, and proprietary business terms to detect potential IP.
Intelligent Labeling: Documents identified as containing IP or trade secrets are automatically classified (e.g., “Proprietary IP”), reinforcing the need for restricted sharing.
Real-Time Access Insights: With Strac, administrators can instantly see who has access to IP-tagged files, enabling them to remove unauthorized users or reduce permission scopes.
Immediate Link Removal: If a contractor or external partner is mistakenly granted access to IP, Strac revokes public or unauthorized sharing before the files can be downloaded.
Alerts & Blocking: Strac’s policies can be configured to alert security teams or block external sharing attempts for files containing proprietary content.
Incident Response & Auditing: Detailed logs of every share request, label change, and access revocation aid in quick incident resolution and help prove due diligence if legal issues arise.