DLP Test Tool
Check whether your Data Loss Prevention policies actually catch sensitive data on the web channel. Generate synthetic test data, scan text against production-grade detectors, and post a controlled payload to see if it is blocked — all from your browser.
Ready-made datasets for the sensitive-data types Turkish and international policies care about most. Every value is fabricated but structurally correct — T.C. Kimlik and Vergi Kimlik numbers carry valid check digits, IBANs pass mod-97, card numbers pass Luhn and come from the card schemes' published test ranges. Copy a set into an email, a web form or a chat window and watch what your DLP does.
These identifiers are generated, not collected. They are valid in format so detection engines recognise them, and they belong to no real person, account or card. Never test with production data.
Build a dataset that matches the policy you are testing. Pick the fields, set the row count, and export as CSV or JSON. Runs are seeded, so the same seed and the same fields always produce the same rows — useful when you need a repeatable regression test rather than a one-off sample.
Fields
Same seed + same fields = the same rows, every time. Maximum 500 rows.
Output
This is the actual channel test. Paste sensitive-looking text, optionally attach a file, and submit it as a normal multipart/form-data POST — exactly the shape of a web upload your users make every day. If your DLP inspects the web channel, it should stop the request before it leaves. The receiving endpoint counts the bytes and throws them away; nothing is written to disk, logged or forwarded.
Command line
A browser on an HTTPS page is not allowed to open a plain-HTTP connection, so the unencrypted channel has to be exercised from a terminal. These two commands send the same payload over TLS and in the clear — run them from a monitored workstation and compare what your gateway or endpoint agent reports.
Use Custom endpoint to point the test at a receiver you control — your own webhook, a lab server or an internal collector. That keeps the whole test inside your perimeter, which is what most security teams prefer for a formal policy validation.
Before you tune a policy, find out what is actually detectable in a document. Paste any text and this runs it against the same class of pattern library Siberson Verikor DLP uses — including checksum validation, which is what separates a real T.C. Kimlik number from eleven random digits and a real card number from a phone number. Everything happens locally; the text never leaves this page.
A valid checksum means the value would survive validation in a real policy and should be treated as a true positive. Format only means the shape matched but the check digit did not — the usual source of DLP false positives, and the reason checksum-aware detection matters.
What the tool can produce and detect
Turkish identifiers are first-class here, not an afterthought — which is where most international DLP test tools stop short.
Türkiye identifiers
T.C. Kimlik No and Vergi Kimlik No with valid check digits, TR IBAN with mod-97 validation, mobile numbers, licence plates and city data.
Payment card data
Visa, Mastercard, Amex and Troy numbers from published test ranges, Luhn-valid, with expiry and CVV for PCI DSS policy testing.
International PII
US Social Security numbers, EU IBANs, EU VAT numbers, passports, driving licences, dates of birth, email addresses and phone numbers.
Health data
US National Provider Identifiers with Luhn validation and ICD-10 diagnosis codes for HIPAA and patient-record policies.
Secrets and credentials
AWS access key shapes, API tokens, JWTs and private-key block headers — the exfiltration path that matters most in GenAI and developer workflows.
Network and infrastructure
IPv4 addresses and host identifiers, for policies that treat internal topology as sensitive.
Built to be shared
The tool is public and free. Use it in your own environment, in a customer's, or in front of a room.
Security teams
Validate that a newly written web-channel policy fires before you switch it from monitor to block, and re-run it after every policy change or agent upgrade.
Partners and resellers
Demonstrate detection live during a POC or a customer workshop without ever touching production data, and hand the link over so the customer can repeat it themselves.
Any DLP vendor's customers
Nothing here is Verikor-specific. The datasets and the channel test work against any DLP, CASB or secure web gateway — which makes it a fair way to compare them.
Questions about DLP testing
What is a DLP test tool?
Is the test data real?
Do you store anything I submit?
How do I test the plain HTTP channel?
My test was not blocked. What does that mean?
My test was blocked. Was it definitely the DLP?
How often should DLP policies be re-tested?
Can I use this with a DLP product that is not Siberson?
Detection is only half the job
Siberson Verikor DLP inspects the web, email, endpoint and cloud channels with the same checksum-aware detection you just tried — and enforces on it. See it against your own data.