The cost of doing nothing
Your employees are already pasting company data into AI
The only open question is whether you can see it, on devices you already manage, today.
Blocking it does not make it stop, it only makes it invisible.
average cost of a data breach in 20251
added to that when shadow AI is involved1
of breached organisations had no AI governance policy1
- 1IBM, Cost of a Data Breach Report 2025: global average cost, the shadow-AI premium, and the governance-policy gap. ibm.com
- 2Cyberhaven Labs, Sensitive Enterprise Data Is Flowing Into AI Tools at Scale, February 2026, 32.3% of workplace ChatGPT usage happens through personal accounts. cyberhaven.com
What it does
It checks the box people type into, in the instant before the send
Banning AI tools moves the problem to a phone you cannot see. Itzal sits on the device instead and checks the box people type into, in the instant before the send.
If it finds something, it warns the employee or blocks the send outright. Your security team gets a record saying what kind of data it was. The message itself never goes anywhere.
Illustration. The data shown is invented.
The family
Install once, then turn on what you need
Everything runs from a single agent and a single browser extension, sharing one detection engine. Switching a product on is a licence change, not a second deployment and not another thing on the laptop.
-
Guard
What people type, paste, upload and screenshot into ChatGPT, Claude, Gemini, Copilot and the rest, in a browser tab or a desktop app, caught before the send.
AI tools
-
Shield
Files leaving the machine by any other door: personal email, file sharing, cloud storage, USB drives and sync folders.
Everything else
-
Mail
Outlook and Gmail, message and attachments, checked before the send rather than reported after it.
Outlook and Gmail
-
Lens
Where the sensitive data already sits, and which AI tools are in use: laptops, over-shared drives, Slack, Teams, databases.
Discovery
Where it sits
A single checkpoint on the device, before anything leaves
One checkpoint on a machine you already manage. It reads, masks, and records the finding without the message.
-
01
What it sees
Everything handed to an AI tool, at the moment it is handed over.
- Typed and pasted text
- Word, Excel and PowerPoint
- Screenshots and images
- Any other file
In Chrome, Edge, Firefox and Safari, and in the desktop apps on macOS and Windows.
-
02
On the device
Four layers read the line and tag what they find.
- Patterns
- Context
- Frameworks
- Your policy
Nothing is sent anywhere for the decision, and nobody’s message waits while it is made.
-
03
What leaves
The send itself and a record, neither of which is the message.
The send itself, with the identifier already replaced.
A record, over mTLS. Four fields and no fifth one holding the text.
Wherever it was going 23 destinations
- ChatGPT
- Claude
- Gemini
- Copilot
- Perplexity
- Grok
- Gmail
- Outlook
- Drive
- Dropbox
- OneDrive
- Slack
- +11
Itzal does not connect to any of these. It watches the drop, the paste and the file picker on the AI tool itself, so a document is read where it is handed over, whatever it was synced from.
Who actually needs Itzal
If your company has employees and a browser, you qualify
In healthcare, higher education, insurance or banking you already know this is yours: a compliance officer is forced to ask the question out loud, because HIPAA, FERPA, GLBA and state regulators make them write the answer down.
The regulation is what differs between industries. The exposure does not. Every company has something worth protecting, and none of it checks its own industry code before landing in a chat window.
Healthcare
Clinicians summarise notes and draft appeals in a chat window.
Patient records leave with the prompt, and with the file attached under it.
Read the healthcare page
Higher education
Marking, admissions and research all happen on the same laptop.
Student records and work still under embargo go out with the text.
Read the higher education page
Insurance
Claims handlers paste policyholder detail in to summarise it.
Claim files and personal financials leave with the question.
Read the insurance page
Banks and financial institutions
Advisers and analysts paste account detail in to draft and explain.
Account numbers and material non-public information go with it.
Read the banks and financial institutions page
Startups
A small team moves fast with whatever tool is already open.
Cap tables, investor decks and unreleased code leave in a paste.
Read the startups page
Agencies and consultancies
One client’s confidential brief sits a tab away from a competitor’s.
Work product crosses between accounts without anyone meaning it to.
Read the agencies and consultancies page
Manufacturers
Engineers paste drawings and supplier terms in to check them.
A specification is a trade secret that does not look like one.
Read the manufacturers page
Retail and e-commerce
Support and marketing paste customer detail in to draft replies.
Records, loyalty data and payment details leave with the message.
Read the retail and e-commerce page
Law and professional services
Associates paste drafts and matter notes in to rewrite them.
Privilege has no pattern to match, only a client list.
Read the law and professional services pageAnd everyone else
Every company has a browser, and something it would rather not lose.
HR records, board minutes, unreleased earnings. Regulation only decides who has to write the incident up afterwards.
Talk to us about your industryYou do not need to be regulated to be exposed. You need a device with a browser, and every business has those. Regulation only decides who has to write the incident up afterwards.
Why a separate control
Every control you own watches something a prompt is not
A file, a connection, a request. Those are the three things your stack was built to inspect, and a prompt is none of them.
| The question | Endpoint DLP | Network / CASB | Endpoint surveillance | Itzal |
|---|---|---|---|---|
| Sees the text typed into an AI tool | No, it inspects files | No, the session is TLS | Yes, by recording the screen | Yes, in the composer |
| Covers files, USB and email leaving | Yes, this is its job | Partly, for sanctioned apps | No | With Shield |
| Can stop one send in the moment | No, it reports after | Only by dropping the connection | No | Warns or blocks that send |
| Where the inspection happens | On the device | In the network | On the device | On the device |
| Who else sees the sensitive text | Nobody | Nobody | The recording vendor | Nobody, ever |
| Reports coverage per surface | No | No | No | Every device, continuously |
The first three columns are not doing this badly. They are doing something else, and the repo’s own note on endpoint DLP reads don’t claim their scope.
These are not substitutes. Endpoint DLP still owns files, CASB still owns sanctioned SaaS, and the gateway still owns which tools are reachable. The useful exercise is naming the rows with no owner. The full comparison.
The next step
Bring your hardest question.
Forty-five minutes on your own data, run by an engineer. We will show you the gaps as readily as the catches.
Book a technical demoThe console
What your security team actually sees
Counts, categories, and the rule that fired. Export what an auditor asks for.
There is no transcript to open, because one was never collected. More about the console.
Overview
1,842 devices reporting · last event 4 minutes ago
Events
2,417
↑ 12% vs previous 30 days
Blocked before send
311
12.9% of events
Devices reporting
1,842
99.0% of enrolled fleet
Message content stored
0
by design, not by policy
Findings by framework
A card number is PCI whatever surrounds it. HIPAA and FERPA findings need health or academic wording nearby, which is why they are not simply the same names counted twice.
Risk mix
Ordered by severity, not by count. A Critical row sorted to the bottom by volume is the row that gets missed.
What was done
The policy decides this per rule. Logging everything and blocking nothing is a legitimate first month.
Recent events
| When | User | Risk | What was found | Policy | Client to destination | Action |
|---|---|---|---|---|---|---|
| 14:22 | r.okafor | Critical | Card number | PCI DSS | From macOS, Chrome to ChatGPT in a browser tab. | Blocked |
| 14:09 | m.delacroix | High | Person name in context | HIPAA | From macOS, Safari to Claude in a browser tab. | Blocked |
| 13:58 | j.whitfield | High | Credential | Internal | From Windows to ChatGPT through its desktop app. | Blocked |
| 13:51 | a.nakamura | Medium | Email address | GDPR | From Windows, Edge to Gemini in a browser tab. | Warned |
| 13:44 | m.delacroix | High | National ID | HIPAA | From macOS, Safari to ChatGPT in a browser tab. | Blocked |
| 13:30 | s.oyelaran | Medium | Bank account | GLBA | From macOS, Chrome to Claude in a browser tab. | Warned |
| 13:12 | p.rasmussen | Low | Phone number | GDPR | From Windows, Chrome to ChatGPT in a browser tab. | Logged |
| 13:04 | t.abadi | Medium | Your own rule: Deal codename | Internal | From macOS, Chrome to Claude in a browser tab. | Warned |
Seven columns, and none of them is the message. The snippet the
real console keeps is already masked, ssn ***-**-6789, and nothing else was stored.
Resources
The questions people ask before they ask us
Each of these is answered in full rather than summarised: provider terms that change, the legal ground for monitoring, and what the three controls in your stack actually inspect.
- Prevention How to stop employees pasting sensitive data into ChatGPT Blocking, training, an AI gateway, endpoint detection, and the failure mode of each. 6 min read
- The answer Does ChatGPT train on pasted company data? What the enterprise agreement actually says, and the five risks that survive a no-training clause. 6 min read
- The law Is monitoring employee AI use legal? Notice, works councils and jurisdiction: what we know, and what needs your counsel. 6 min read
- The comparison AI DLP vs CASB vs endpoint DLP What a CASB, endpoint DLP and a web gateway each inspect, and the surface that falls between all three. 6 min read
Straight answers
Everything else people ask us
Short answers, in the order they usually come up. The longer versions are in the articles above.
Does Itzal read my employees' conversations?
No. The check runs in a small program on the endpoint, and the raw text is never transmitted, stored off the device, or written to a log. Administrators see data types, counts and risk scores. They never see the message.
Can it stop something, or only report it?
Both. Itzal can log quietly, warn the employee inline, or block the send outright, set per framework and per destination, so an approved tool and a personal account are treated differently.
Is deploying this legal where we operate?
That depends on jurisdiction and needs your counsel, not a vendor's reassurance. Several US states and most EU member states require advance written notice for endpoint monitoring. What we know, and what we don't.
What does it cost to be wrong about this?
The average data breach reached $4.44M in 2025, and shadow AI added $670K on top. 63% of breached organisations had no AI governance policy at all. Those are IBM's figures, cited on this page.
Will my employees just use their phones instead?
Some will, and no endpoint control reaches a personal phone. That is the honest limit. What Itzal changes is the easy path: pasting into a browser tab on a managed laptop is where most of this happens, because it is where the work already is.
How long does it take to deploy?
One installer and one install, pushed by your existing MDM. There is no appliance, no proxy and no certificate to distribute. Turning on another product later is a licence change rather than a second rollout.
What happens if the detection is wrong?
A false positive warns an employee who did nothing wrong, which is why the thresholds are yours to set and every rule can log rather than block while you tune it. Name detection is measured at 0.959 precision on our corpus, and the figure is published rather than claimed.
Does it work with the AI tools we have approved?
Yes, and differently from the ones you have not. Policy is set per destination, so a sanctioned tool can warn where a personal account blocks.