Detection engine
The layers, the accuracy targets, and how quality improves without collecting your text.
1 · Capture
Three layers, because no single method covers everything.
The extension is primary because most AI tool use is web-based, and because it reads the composer before submission — which is what makes blocking possible without intercepting TLS.
| Method | Covers | Trade-off |
|---|---|---|
| Browser extension, MV3 | ChatGPT, Claude, Gemini, DeepSeek, Perplexity and other web AI tools | Does not see native desktop apps or API calls |
| Local TLS proxy, opt-in | Desktop AI apps, LLM API calls from internal scripts | Requires a device-trusted CA; certificate pinning breaks some apps |
| Clipboard and window-title heuristics | Fallback signal across any app | Noisy; no content-aware targeting on its own |
2 · Detect
Layered, local, deterministic first.
Each stage narrows what the next has to look at, so the expensive layer only ever runs on candidates rather than on every submission.
- 01
Pattern layer
National IDs, card numbers with Luhn validation, IBAN and routing numbers, cloud provider key formats, private key headers, passports, phone, email. Fast and deterministic.
- 02
Contextual layer
A small quantised model, on-device, for names in context, addresses, and health terminology that patterns cannot reach. Runs only on candidates.
- 03
Framework mapping
Each hit classified against HIPAA, PCI DSS, GDPR/CCPA, FERPA, GLBA, SOX or Internal — so the console reports by obligation rather than only by data type.
- 04
Custom rules
Your own regex and keyword lists: project codenames, customer ID formats, deal names, classification headers.
3 · Redact
Before the record exists, not before it is sent.
Matched spans are masked at the point the event record is constructed. The unredacted value never populates a serialisable struct, never reaches a log sink — including in debug builds — and never touches the local buffer in plaintext. The buffer is encrypted at rest regardless.
4 · Enforce
Log, warn, or block.
Configurable per framework, per department, and separately for sanctioned versus unsanctioned destinations.
Blocking requires DOM control, so it applies to browser-covered tools. On proxy-covered surfaces the honest posture is warn-then-log, and the console labels it that way rather than implying enforcement it cannot deliver.
| Action | Behaviour |
|---|---|
| Log only | Silent; the event appears in the console and the SIEM |
| Warn | Inline banner in the composer. The decision, and the outcome, are recorded |
| Block | The submit is intercepted; the person must edit before sending |
The fail-open contract. If no decision has returned within the deadline, the extension releases the submit and downgrades the event to log-after-send with a flag. An agent that hangs, crashes, or was never installed produces the same behaviour as one that is merely slow. Fail-open is the right default — but it is visible, because silent fail-open is how a DLP reports perfect health while protecting nothing.
5 · Report
To your console and your SOC.
Events land in an append-only store, scoped to your tenant by identity derived from the mTLS certificate chain rather than any client-supplied field. From there they reach the console and your existing tooling: Splunk HEC, Microsoft Sentinel, Google SecOps, Elastic, a generic webhook, or RFC 5424 syslog with a CEF payload. Push for latency, pull with cursor paging for gap recovery.
Only redacted records go out. That rule does not relax because the destination is your own SIEM — a different retention and access model does not make the content safe to send.
Go deeper
Browser extension
What it hooks, how it stays bound when a site redesigns, and what it cannot reach.
Admin console
What your security team sees, and how it reaches the SIEM they already watch.
Deployment
MDM packaging, staged rollout, and the legal prerequisites that come first.