Don’t block AI. Mask the data instead.
The reflex is to lock ChatGPT down — block the site, stop the upload, file a ticket. But blocking is a tax on the work. You can let your team keep using AI and keep the sensitive data out of it, at the same time.
Blocking treats the tool as the threat.
The data is the threat — not the AI. Most “AI DLP” tools inspect a prompt and, if they spot something sensitive, stop it. Safe, in a narrow sense. But every block is a person who couldn’t do the thing they were trying to do, and a reason to route around the tool entirely.
The block-first approach
Detect → stop the upload
A sensitive prompt is refused. The interaction fails. Your team learns that AI plus real work equals friction — so they paste it into a personal account where nothing is watching.
The mask-and-restore approach
Detect → swap → restore
The PII is replaced with a realistic stand-in before the prompt is sent. The AI still answers. The real values are put back in the reply, on your device. The work continues; the data never left.
What actually leaves the browser
Draft a follow-up to jason.smith@acme.com about card 4111 1111 1111 1111
Draft a follow-up to dana.lee@example.net about card 4024 0071 5376 2213
Realistic, not redacted. The stand-ins are valid-shaped — the model responds normally instead of choking on [REDACTED] — and they’re reversible: the reply comes back with the originals restored.
“On-device” isn’t one thing.
Plenty of tools say on-device. Ask a sharper question: to decide whether your prompt is sensitive, does the prompt itself get sent somewhere to be read? For many, the answer is yes — the text is shipped to a vendor cloud, then to an AI model, to be classified. On-device network, off-device data.
Classify in the cloud
common approachYour PII crossed two clouds just to be judged — protected by a retention promise, not by architecture.
Classify in your browser
TrustevoNothing crossed. The raw prompt never left the machine — zero egress, enforced by the browser itself.
Zero-retention is a promise.
Zero-egress is architecture.
Four questions that separate real protection from theater.
- 01
Does it let people keep working?
Masking beats blocking. If the answer to sensitive data is “request denied,” your team will find a path around the tool — and around you.
- 02
Does the prompt ever leave the device to be checked?
“On-device” should mean the classification runs locally — not that a local agent forwards your text to a cloud. Ask where the detection actually happens.
- 03
Is the masking reversible and realistic?
Valid-shaped stand-ins keep the model useful and let the real values return in the reply. Bracketed [REDACTED] tokens break both.
- 04
Can a person turn it on without IT?
Protection that needs an MDM rollout protects the fleet on IT’s timeline. A browser install protects the person who needs it today.
Keep using AI. Keep your data.
PII Guardrail masks sensitive data on your device before it reaches ChatGPT, Claude, and the rest — and restores it in the reply. No block. No cloud. No ticket.