Privacy architecture
Itzal runs its detection engine as a local process on the employee’s device. Only a redacted event record — type, count, confidence, masked snippet, risk score — is transmitted over mutual TLS. The raw prompt text never crosses the network boundary.
The boundary
“Privacy-first” is a phrase every vendor uses. The only useful response is to say precisely where the boundary sits and how it is enforced.
| Stays on the device | Crosses the network | |
|---|---|---|
| The prompt the employee typed or pasted | Yes | Never |
| The AI tool’s response | Yes | Never |
| Attached file contents | Yes | Never |
| The matched sensitive value itself | Yes | Never |
| Salted hash of the matched value | Optional, local audit trail | Never |
| Finding type, count and confidence | Yes | Yes |
| Masked context snippet | Yes | Yes |
| Destination, and whether it is sanctioned | Yes | Yes |
| Risk score and the action taken | Yes | Yes |
The record
snippet is masked, not tokenised. The characters are gone, not encoded. There is no vault, no key, no reversal — not for Itzal, not for your administrators, not for anyone who compromises the event store. It exists so a reviewer can judge intent without ever seeing the value.
action_taken is the decision that executed, read back from the enforcement path — not the policy’s intended action. A policy set to block that fell back to warn because the deadline expired reports warn. A console that reports intentions rather than outcomes overstates its own protection.
{
"event_id": "b9c1f0e2-…",
"device_id": "sha256:9f3a…",
"user_id": "corp-directory-id",
"destination": { "app": "claude.ai", "is_sanctioned_tool": true },
"findings": [{
"type": "SSN",
"framework": ["HIPAA", "Internal-PII"],
"count": 1,
"confidence": 0.97,
"context_snippet_redacted": "my ssn is ***-**-6789 please reformat"
}],
"risk_score": "Critical",
"action_taken": "blocked"
}
Why it is architectural
Four mechanisms make the boundary structural rather than configured.
Both layers run inside the local agent process. There is no classification API, so there is no endpoint that could be pointed at a server — not by misconfiguration, not by a future feature, not by a support engineer under pressure.
False-positive text never leaves the device and there is no mechanism to request it. Quality comes from synthetic generation, public corpora, aggregate counters and analyst labels on already-redacted snippets.
Most real leaks in security products are not exfiltration features — they are a debug print somebody forgot to remove.
Static checks fail the build on a raw span reaching a log macro, an unmasked field on a serialisable struct, or a non-TLS transport path.
The second one is the constraint most likely to be argued away in month eight, when there is pressure to improve the numbers. Designing the alternative up front is what makes the answer “no” rather than “well, if it’s opt-in”.
What it costs
Investigation depth. An analyst seeing a Critical event cannot pull up the full prompt. If your process requires reading what the employee wrote, Itzal is the wrong tool — and any tool that offers it is one breach away from being the incident.
Tuning is slower. Without customer text to learn from, improving a noisy detector takes synthetic corpus work rather than a feedback button.
Some surfaces stay uncovered longer. Everything is bounded by the endpoint’s budget. OCR for pasted screenshots cannot fit inside a blocking path and is a log-after-send capability at best.
They are on this page because a vendor that lists none is hiding them.
Ask any vendor
Endpoint, your cloud, or the vendor’s.
If reversible, who holds the key.
Under any workflow at all.
And under what consent.
This is where the real leaks are.
And is that published.
Those differ more often than anyone admits.
Straight answers
No. The snippet in an event record is masked rather than hashed, so there is no key that reverses it. The optional exact-value hash is salted per device and stored only on-device — it is never transmitted.
No. Redaction of matched spans before printing is enforced in debug and development builds as well as production, and a CI check fails the build on violations.
On the device. Both the pattern layer and the quantised model run locally inside the agent process. No text is sent to a server for classification.
A packet capture, a unique string and an afternoon. It is the only claim in this category you can check without trusting anyone.