PCI DSS and AI tools
What the standard has to say about a prompt box, and why the card number is the easy part.
Read itWhat we solve
Where a record actually goes
The prompt box is the one everybody worries about. Email, removable drives and the folders that sync a laptop to a personal cloud carry the same material out, and none of those three passes a web proxy.
-
A client record leaves in an email
- Outlook
- Gmail
Statements, applications and suitability letters, going wherever autocomplete put them.
Itzal Mail reads the message and its attachments inside Outlook and Gmail, before the send leaves the client.
-
Account detail goes into an AI tool
- ChatGPT
- Claude
- Gemini
- Copilot
A position pasted whole to be explained: account number, holdings, the client’s name.
Itzal Guard reads the composer, and the file attached to it, on the employee’s own device.
-
Exports walk out on a drive
- Drive
- Dropbox
- OneDrive
- USB
A book of business pulled from the CRM, then uploaded, synced, or copied onto a stick.
Itzal Shield applies one policy to uploads, to USB and to the folders that mirror a laptop.
The record
Whichever of the three stops it, your console is handed the same thing: which identifiers fired, which framework they mapped to, where it was going, and whether that device was covered at the time, with nothing readable anywhere in it.
- Guard
- Shield
Worked example
What a prompt takes with it
The task is ordinary and the tool is the one people already use. Itzal checks the text on the device, in the instant before it is sent.
If it finds something a framework covers it warns or blocks, and your security team gets a record naming the finding types. The message itself never goes anywhere.
Illustration. The data shown is invented.
Why the context rule matters
A number only becomes a finding from the words around it
An account number in a vendor invoice is noise. The same number beside a loan application is a GLBA finding, which is why the context list is a setting and not a constant.
Itzal scores an identifier together with the words around it, so the same string is a finding in one sentence and noise in the next. A detector that only matched patterns would have to choose once, for every sentence.
Client R. Alvarez, account 8841-0073-2, routing 021000021, applying for a home equity line against the property at…
A routing number has a checksum and a pattern finds it anywhere. An account number does not, and on its own it could be an invoice reference; it is home equity line three words later that makes this a GLBA finding. Invented data.
Scored alongside the identifier
- account number
- loan application
- routing number
- credit report
Seeded by the finance template, then yours to edit. How the detection layers work
Compliance
Built for the frameworks you answer to
The three above come on the day you pick the finance template, and GDPR comes with them. The rest are a licence away, and every one of them reads the same text on the same device.
-
GLBA
Account numbers, routing numbers and the loan detail that travels beside them.
-
PCI DSS
Cardholder data wherever it turns up, which is usually not the payment page.
-
SOX
Draft results and the financial detail that is material before it is published.
-
See it on your own policy
Forty-five minutes with an engineer, against the frameworks you actually answer to.
Book a demo
Also licensed, and off until you ask for them
- GDPR On, set to warn
- State privacy CCPA and CPRA
- HIPAA Health data in a claim or a file
- Your own rules Codenames and your own entity types
A framework here is a detector set and an action, not a certificate. What it finds, and what it does when it finds it, is yours to set per department.
Getting started
You can be covered by this afternoon
One installer, one browser policy per browser family, and the MDM you already run. No appliance, no proxy, and no certificate to distribute.
-
Hour 0
Sign in, pick the template
The finance template sets your starting policy. Nothing has touched a device yet.
-
Hour 1
Push one installer
One signed package per platform, carrying the detection model, so there is nothing else to stage.
-
Hour 2
Add the browser policy
One per browser family. Chrome, Edge and Firefox each need their own, and this is the step rollouts get wrong.
-
Hour 3
Read coverage, not installs
The console shows whether the composer actually bound on each site. A clean install that never binds looks identical from the installer’s side.
-
Same day
Findings start arriving
You can see what is being sent, and to where, before anything warns or blocks.
Those hours are a pilot group, not a fleet. And nothing is warned or blocked until you say so: enforcement waits on a measurement of false positives against your own language, which takes weeks rather than hours. The staged rollout.
Straight answers
The questions a review always asks
They are answered here rather than saved for a call, including the ones where the honest answer is that it depends on your own counsel.
Can we block card numbers without disrupting developers?
Yes: exception-list your known test card numbers. Blocking checksum-validated PANs while allowing documented test fixtures is the standard configuration, and it removes most of the friction.
How does this reach our SOC?
Splunk HEC, Microsoft Sentinel, Google SecOps, Elastic, a generic webhook, or RFC 5424 syslog with a CEF payload, at-least-once with a stable event ID for deduplication.
Can we detect material non-public information?
MNPI has no reliable pattern, so it is handled through custom rules (deal codenames, project names, document classification headers) which your administrators maintain.
Does Itzal see the message itself?
No. The check runs in a small program on the device, and the raw text is never transmitted, stored off the device, or written to a log. Your console receives finding types, frameworks and the action taken.
How long does deployment take?
One installer, pushed by your existing MDM. There is no appliance, no proxy and no certificate to distribute, and turning on another product later is a licence change rather than a second rollout.
What does Itzal not see?
Plenty, and we publish it rather than wait to be asked. Coverage is reported per surface and the uncovered ones are named. Surface coverage.
Can people still use AI tools after this is installed?
Yes, and that is the point. Banning them moves the work to a phone you cannot see. Itzal checks what is about to be sent and only intervenes when a rule you set says it should.
What happens when a detection is wrong?
You set the thresholds, and any rule can log rather than block while you tune it. Name detection is measured at 0.959 precision on our corpus, and the figure is published rather than claimed.
Not legal advice. Whether a particular disclosure is reportable is a determination for your own advisers, not for a vendor.
More questions, answeredRead next
The detail behind the two hardest questions
One is what the rules actually say once data is inside a prompt. The other is what your own team is handed afterwards.
The framework view in the console
Findings by team, department and framework over time, on records that carry no raw employee content.
Read it