You cannot read the prompt
Not with an admin role, not with a support escalation, not with a court order. The data was never received.
Two architectures
Almost every product is one of these.
The second is harder to build and easier to defend.
Transmit, then classify
Content goes to a server — the vendor’s or yours — where a model inspects it.
- Gains: heavier models, no endpoint footprint, easy tuning from real examples.
- Costs: the content of employee communications now exists in a second system, with its own retention, access model and breach surface.
Classify, then transmit
Detection runs locally; only a derived record is sent.
- Gains: raw content never exists off-device, the minimisation argument is straightforward, and there is no content store to breach.
- Costs: endpoint compute budget, slower tuning, and no ability to look at the original afterwards.
What an analyst sees
The snippet does more work than it looks like.
Surrounding words survive, so a reviewer can distinguish “here is a test fixture” from “here is a real customer, reformat it for me” — which is most of what triage needs — while the value itself is gone.
Note masked, not tokenised. Masking destroys the characters. Tokenisation replaces them with a reference something can reverse. A vendor offering “reversible for authorised investigators” is offering a content store with extra steps.
{
"type": "SSN",
"framework": ["HIPAA", "Internal-PII"],
"count": 1,
"confidence": 0.97,
"snippet": "my ssn is ***-**-6789 please reformat",
"destination": { "app": "claude.ai", "sanctioned": true },
"risk_score": "Critical",
"action": "blocked"
}
What you give up
Say it plainly, because a vendor who won’t is hiding it.
If your investigative process genuinely requires reading what people wrote, this architecture is the wrong fit — and you should be clear-eyed that the alternative means holding a searchable archive of your employees’ messages.
Tuning is slower
No feedback loop from real false positives, so quality comes from synthetic corpora, public data, aggregate counters and labels on already-redacted records.
Heavy models do not fit
Everything runs inside the endpoint’s budget, which rules out approaches needing a GPU — OCR on pasted images cannot sit inside a blocking path.
It is harder to build
Which is most of why the industry defaulted the other way.
Test the claim
Don’t take anyone’s word, ours included.
A vendor confident in the claim will help you run this. One that deflects has told you something.
- 01
Install the agent in a lab
On a device you control.
- 02
Capture its outbound traffic
At the network layer, not from the product’s own logs.
- 03
Submit a known unique string
Through a covered AI tool.
- 04
Search the capture for it
And for any encoding of it.
- 05
Repeat with debug logging on
Debug builds are where real leaks live.
Straight answers
If administrators can’t read the message, how do they investigate?
From the data type, the count, the confidence, the masked snippet, the destination and the risk trend for that user. The masked snippet preserves surrounding words, so a reviewer can judge intent without seeing the value.
Is the masked snippet reversible?
It should not be. Masking removes the characters; tokenisation replaces them with something a key can reverse. Ask which one a vendor does, and if it is reversible, ask who holds the key.
Doesn’t this make detection worse?
It makes tuning slower, because the product cannot learn from the examples it got wrong. Quality has to come from synthetic corpora, public data, aggregate counters and analyst labels instead.
How would I verify a vendor’s claim?
Capture the agent’s outbound traffic in a lab with a known sensitive string, and inspect what is actually transmitted. Any vendor confident in the claim will support that test.