A computing platform may receive, from a network device, a message identifying data that was transmitted by a user device located in a private network associated with an organization. The network device may be located at a boundary between the private network and a public network. The data may include one or more images and may be destined for a network address associated with the public network. The computing platform may generate and store a record corresponding to the message. The computing platform may receive, from an analysis platform, data indicating whether the image(s) comprise content that violates a data leak prevention (DLP) policy of the organization. The computing platform may identify the record corresponding to the message and may update the record corresponding to the message to reflect whether the image(s) comprise content that violates the DLP policy of the organization.