In all of my experience with Data Loss Prevention systems, simply giving away a bag of money doesn't guarantee you that no data would be leaked. DLP usually does what it is told to do, but it is hard for anybody as a DLP administrator to predict all the ways in which data could leak from their organization. After all, you're trying to stop a human with a machine and people still tend to outsmart computers (and the people who configure them) ocsasionally.
Then again, even if you had the perfect system which prevents leakage of all required data over all existing channels, somebody could just flip out their phone and take a photo of the monitor with the sensitive data on it. Therefore, strict internal practices should be developed and applied in order to secure the data as much as possible.
Now, to directly answer your question:
Wondering what are DLP options suitable for a small startup
I've had pleasant experience with Forcepoint DLP and I believe it would be best suited for your case because:
- It is easy to configure;
- It contains scripts and methods to detect source code out of the box;
- The solution includes risk scoring which makes it easy to apply the correct action depending on the user's past actions so the business process wouldn't be harmed;
- The vendor's other solutions include User and Entity Behavior Analytics which might also be useful for your case.
The latter two options might appear to be too much for a startup, but, as serverAdmin123 mentioned, it's not the company size that matters but the value of the data.
Most likely there are other solutions on the market which could be more beneficial for your customer or they might require a custom-built solution, but this is subject to discussion between you and them.