The surfaces Itzal inspects, including the ones it misses

A file chosen, dropped or pasted into a supported AI site is taken off the page, read in full on the device, and handed back only if the policy allows it. There is no size limit. Itzal reads plain text, CSV, JSON and source; Word, Excel and PowerPoint, old and new formats, with every sheet and slide and the speaker notes; PDFs, including scanned pages when OCR is on; and ZIP archives nested up to three deep.

A file is judged by its bytes rather than its extension. Encrypted files, 7z, RAR and gzip archives, fax-encoded and JPEG 2000 scans, and text saved as UTF‑16 are not read. They are blocked by default, and an administrator can relax each reason to a warning or a log entry.

With Text in images licensed and switched on, a pasted screenshot, and any picture inside a Word, Excel or PowerPoint file, is held, read on the device, and judged on what was found in it. Nothing is uploaded to be read.

With it off, the image policy still lets you warn on or block every image pasted into an unsanctioned tool, but nothing looks inside the picture, so those events carry no findings. An image the engine could not read is reported unscanned, never clean.

A typed or pasted message is scanned up to 1 MB in Chrome, Edge and Firefox, and up to 512 KB in Safari. Past that the rest is not read, the person is told that only the beginning was checked, and the partial scan is counted in the console’s figures. Attached files are not subject to this limit.

Only the message box, at the moment someone presses Return or clicks Send, and the files and images they paste, drop or pick in the app’s file dialog. On the Mac it also reads the labels of the attachment chips beside the message box, to count what is attached. A file chosen through the attach button is checked before the app can open it. What is read is checked on the device, and only a masked record leaves it.

It never reads window titles, keystrokes, the screen or the conversation, and it looks at the clipboard only at the moment of a paste or drop. Each app is off until it is switched on in the console. On a Mac without device management, setup walks the person through the permissions step by step.

Itzal keeps a signed list of personal email, file sharing, cloud storage and social sites, and each of those kinds is its own switch. One more switch covers every other website. Each is off until an admin turns it on and confirms staff were told. On a covered site, a file attached, dropped or pasted is held and read in full, as it is on an AI site, and at the deeper setting text typed into a form is checked when the form is sent.

Banking, health, government and union sites are never inspected at any setting, so an employee sending their own medical file to their doctor produces no event. Password, one-time-code and card fields are never read. Plain http sites and uploads inside an embedded frame are not checked, and Firefox can withhold the site access the check needs.

Only the message being sent: its body, subject, attachments and recipients, Bcc included. In Outlook an add-in inside the client does the check, with the detection engine running in the add-in on the device. In Gmail the browser extension does it. Recipient addresses are read to tell inside the company from outside, and are masked in the record. The inbox, other folders, contacts and the calendar are never read.

If Outlook’s own time limit for an add-in runs out, the mail is sent with a visible notice that it was not checked.

The agent reads the file being written, at the moment it is written, and nothing else on the drive or in the folder. When the action is block and the check finds something in time, the copy is stopped. When the check cannot finish in time, the copy goes through and is recorded, because hanging the machine would be worse.

On a Mac a sensitive copy is removed from the drive just after it is written, so someone who pulls the drive out in that moment leaves with it, and the deleted bytes may still be recoverable. A Mac can instead be set to refuse every write to a drive that is not approved, which reads nothing. Approved drives are named by vendor and product id.

Copilot, Cursor and Continue run inside an editor, and Claude Code runs in a terminal, where no browser mechanism reaches. Vendor logs do not close the gap either: GitHub’s Copilot audit log excludes prompts, generated code and the files used as context. Until there is an integration, the agent can report which assistants and MCP servers each device has configured, which tells you where to look. It does not read anything typed into them. Claude Code is next on our roadmap, then the Codex, Cursor and Copilot agents.

A hostname and a count, and nothing else. A page counts as an AI chat only when it has a message box, a send control and AI wording in its own interface. Discovery never reads page text, the title or anything typed, and reports one row per device per host per day, suppressed until enough devices have seen it.

It is off until your organisation turns it on, and the setting travels in the signed policy. A host on that report is one where nothing is inspected, which is the point of the report. Finding the AI tools already in use.

Because a browser extension would cover it badly. What Copilot in Word or Gemini in Docs reads is the document, fetched on the provider’s servers, so an extension would see only the prompt typed into the side panel and record a clean send for the request that exposed the file.

Watching that panel would also need script access to the whole mailbox or document store, the largest permission in the product. Purview and Workspace DLP sit where the content is, so the console marks these rows as covered elsewhere rather than planned. A row marked planned invites a team to wait for us with the Purview rule still switched off.

Nearly. Safari has a signed build that can be deployed by policy, like the other two. The attachment readers are the same code in all three builds, but handing a held file back to the page has been proven on Chromium and Firefox and not yet measured in Safari. A file chosen through an attach button that a site builds in script may be missed there. Edge uses the Chrome build.