Accept your invitation using the invited email address, then open Get started. Progress comes from your current workspace's members, agents, connections, credential reports, scans and policies. Owners and admins can complete setup; members can read progress and findings.
Invite your team
Only an owner can invite a colleague. The step completes once the workspace has more than one member; sending an invitation alone does not complete it. An owner or admin can also choose Skip for now in the checklist. This optional step never prevents setup from finishing.
Install and connect
Follow the agent install guide, then add a connection and its agent credentials. Microsoft 365 and Google Workspace have dedicated connector guides linked from the connection form and the checklist. Choose a small, representative folder, bucket prefix or mailbox scope for your first scan.
Run your first scan
In Scans, select your connection, leave the backend at its default, and queue the scan. The assigned agent picks it up when it is online and its credential report is present. Refresh Scans to follow the status. Queued, running, cancelled and failed scans do not complete the checklist: wait for completed. If it fails, inspect the status and check source access and credentials before queueing again.
Review findings and set a policy
Open Findings to review detected labels and confidence, and Coverage to see what was sampled or skipped. A completed scan can have no labelled findings; review its coverage too.
Then open Create a monitoring policy, name the policy and choose the minimum number of labelled files that should record a match. It monitors future completed scans without changing source files. The policy appears immediately; evaluation history appears after a future completed scan. Creating a policy completes step 6.
Once all five required steps are complete, the dashboard hides the checklist. The Get started guide link stays available on the dashboard.
Scope, exclusions and schedules
Open all connector guides for the fields and permissions for your type.
In Connections → View/edit, enter Exclude patterns, one per line, such as
*.tmp, Archive/* and */cache/*. Matching is case-sensitive, against the
relative path or basename. For cloud drives, matching uses item names rather
than the full folder hierarchy. Mail API enumeration may fetch bounded message
payloads before part exclusions. Read your connector's scope notes.
Use at most 100 globs, each 1–256 characters. Use / separators. Do not use
absolute paths, URLs, .., backslashes or regular expressions. Exclusions
filter scanning; they do not narrow the credential's provider permissions.
In Scans, create a schedule, select the connection and choose its cadence. Interval uses elapsed seconds (minimum 60); Hourly uses elapsed hours. Daily, Weekly and Monthly use workspace wall time and the selected clock time. Weekly selects weekdays. A monthly day missing from a short month uses that month's last day. Set the workspace time zone there before choosing calendar schedules. A daylight-saving gap moves the clock forward by the gap; a repeated clock time runs once at its first occurrence.
An optional scan window delays work until its next opening; the end is exclusive and a window may span midnight. Pause a schedule to stop future runs, or disable its connection. Pausing an agent prevents new pickup while it keeps checking in. Keep the agent online and credentials valid for recurring scans.
Understand coverage and sharing
Completed means the scan finished, not that every byte or file was fully classified. Common text, PDF text and modern Office formats have parsers. Other formats receive strings-only checks. Text in images and scanned PDFs needs OCR, an optional premium feature a workspace owner enables; it runs inside your agent with the OCR agent image. Corrupt/encrypted files can fall back to strings-only checks. Inspect Coverage for sampled, parsed and skipped content.
Read Who can see it to distinguish broad sharing, unknown evidence and old files that need review. See Security for what is stored and the optional AI-assist exception. See Upgrade your agent when the console reports an unsupported version.