The leak stops where it starts.
Chrome, Edge and Firefox. It reads the message box and the upload before send.
Three things happen before send.
All of it on the device, in the employee's own tab.
It reads the composer.
Message box, paste, file picker and drag-and-drop all go through one scan.
- Reads before encryption, intercepts nothing
- Manifest V3, no privileges beyond the page
- Installed centrally through the browser's enterprise policy
It applies your policy.
Redact masks the value in the box. Block stops send and gives the reason.
- The employee sees a banner naming what happened
- A block offers a safe version
- No silent drops, ever
It writes one line to the log.
Data type, salted hash, timestamp, destination, outcome. Never the content.
- The IBAN itself never leaves the device
- Delete the salt and every record becomes anonymous
- The same log the auditor verifies offline
"snippetHashes": ["6cd7d48d…"],
"action": "REDACT",
"subjectToken": "subj_789d7"
That is the whole payload.
What it stops, in practice.
An IBAN masked before send.
Someone pastes a payment instruction into ChatGPT. The IBAN is masked in the box. The rest goes through.
- Checksum-validated, so almost no false alarms
- The user presses send again after masking
- One line in the log, no content
A document stopped before it leaves.
Picker, drag-and-drop and paste all pass through one on-device scan. Word, Excel, PowerPoint, PDF, CSV, text, Markdown and JSON.
- Files needing redaction are stopped, not rewritten
- Scanned PDFs are flagged as uninspectable, not read
- The guard fails open on error
A non-EU provider blocked by rule.
Block destinations by residency or sanction status. The employee sees the reason, not a silent failure.
- Six AI sites today, stated in the contract
- The site catalogue updates without a release
- Desktop apps steered in by a device blocklist
Every payload we ever sent, on one page.
The extension's own options page lists the last hundred wire payloads: labels, hashes, metadata. No IBAN, no BSN, no file contents.
- Show it to the works council
- The privacy argument, made by the product
- Nothing to take on trust
What we see. What we don't.
We say it in the product and in the contract.
| Surface | Sees content | Redacts | Blocks | How |
|---|---|---|---|---|
| Browser AI toolsChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek | Full | Yes | Yes | The extension reads the page before encryption |
| Developer APIs, agentsSanctioned tools and automation | Full | Yes | Yes | Opt-in gateway, keys you issueNo interception |
| Native desktop appsClaude Desktop, Slack and similar | Metadata only | No | Destination | A device blocklist steers use into the browserDiscovery only |
| Scanned documentsPDF or image without a text layer | Flag | No | Yes | Flagged. Your policy decides.No text recognition yet |
No proxy. No root certificate. No kernel driver. No app hooking.
What IT asks first.
01Which browsers?
Chrome, Edge and Firefox, on Manifest V3. Installed centrally through the browser's enterprise policy. Updates come only from the web store.
02Does it slow the browser down?
Detection runs on the device. The checksum layer is measured in milliseconds. If the scanner errors or times out, the upload guard fails open, visibly in the console. A broken scanner cannot break an AI site.
03What happens when a vendor redesigns their page?
The extension has several ways to find the message box, plus a self-test and a catalogue that updates without a release. Coverage is still bounded to the sites we list, and the contract says so.
04Can it read anything other than the AI sites?
No. Its permissions cover the six AI sites in the coverage table. Nothing else.
05Does anyone see what an employee typed?
No. Content is never stored or transmitted. We receive a data type and a one-way salted hash.
06What about the desktop apps?
We generate the blocklist for your device-management tool. It removes or constrains them and steers use into the browser, where the extension can see it. We never read desktop content.
Let's talk.
Thirty minutes. You watch the product stop realistic data in a real browser.
- Six leaks: three prompts, three files, live
- The dashboard a security lead sees on Monday
- An evidence pack exported and verified while you watch
- Whether a proof of value in your estate makes sense