Watch · on the device

What leaves a laptop, governed before it leaves.

A browser extension for the AI sites your people already use, and an on-device agent for the documents and chats behind them. Both run the same rules as the gateway, and both say plainly that the content never reached us.

Install on a laptop Download the extension

The browser extension

Runs on ChatGPT, Claude, Gemini and the Microsoft Copilot surfaces, and nothing else. A paste, a typed value or a dropped file is checked before the page sees it. Its detector is the gateway's own rule set compiled to WebAssembly, so a receipt carries the same ruleset version either way.

Three modes, set by your policy: monitor, substitute, block. No mode offers a “send anyway”.

attested · the service sees classes and counts, never content

The on-device agent

A small service on the machine. It governs documents the extension hands it, runs the model tier for names and addresses, keeps the substitution map in an encrypted vault on the device. The CLI beside it can front a local model server such as Ollama.

Installers for Mac and Windows. Installs Tesseract for scanned pages. Never locks a person out of their own machine.

receipts signed on the machine, with the device's own key

Documents

Upload a notice. The AI reads a look-alike.

Drop a PDF into a chat and the agent rewrites it first. Every private value is swapped for a stand-in of the same shape, drawn from a range its issuer never uses, so the document stays a document and the model still understands it. The reply comes back on screen with the real values put back.

Text PDFs are rewritten in place; scanned pages are read by Tesseract and painted over
Box out anything by hand: it is blacked out and recorded as marked by you, not by a model
What could not be located is listed on the receipt as left, never hidden

How substitution works

The stand-in shapes · values invented

ClassStand-inWhy it cannot be real

pci.card_number9999 3507 5774 0496a BIN no network issues

pii.in_aadhaar0253 1977 7341starts with 0; Verhoeff-valid

pii.in_panLYNPT9212Qholder-type letter kept

pii.us_ssn9xx-xx-xxxxarea 900–999, never issued

pci.ibanGBxx LYNT …mod-97 valid, bank code LYNT

pii.bank_account_number9999 5442 8153 341same length, 9999 prefix

pii.phone+99 …country code 99 is unassigned

pii.person_nameKelron Mellkarsyllable-built, never a real list

pii.date_of_birth20/02/1937separators kept, year 1900–1939

Honest about the vantage point

The content stays on the machine, and the receipt says so.

The gateway handles the bytes and records observed. The extension and the agent report what they found and record attested, because we did not see the traffic. The console shows the two differently, on purpose. Silence from a device is never shown as clean.

observed

Gateway, mail routes, uploaded files through the service.

attested

The browser extension and the on-device agent.

asserted

A caller that described its own action. Never promoted.

Said plainly

What it does not cover.

A browser tab the extension does not cover, a native app with its own HTTP client, or a hard-coded endpoint are invisible to the agent. The coverage page says so.

Editors with their own subscription are only half reachable: a base URL applies to models you add with your own key, and whatever comes bundled goes to that vendor's servers.

A streamed reply through the local proxy is not restored byte by byte; a model's own tokeniser splits a substitute across chunks. Streamed text is restored in the browser, where it is assembled.

A scanned document without a readable text layer is read by Tesseract. Where a value cannot be located on the page, the receipt says what was left, rather than claiming a clean copy.

Two minutes on a laptop. One receipt to check.

Install the agent, add the extension, paste a test value into a chat, then open the receipt in the verifier.

Install on a laptop Read the coverage page