Privacy by design
Protection without creating another copy of your data
A cloud-based scanner may need content to be uploaded before it can inspect it. That can create an additional transfer and another system handling the information. DLP Shield instead brings the screening rules to the device, so the check takes place where the work is already happening.
What stays on the device?
- Chat prompts
- Supported document contents
- Text read from supported images
- The sensitive values that are detected
- Matching against enabled categories
- Checking custom rules
- Preparing redacted content
- Deciding whether to warn or keep content out
What is managed centrally?
DLP Shield can synchronise the controls and service information needed to manage protection, such as the organisation’s screening plan, protected devices and subscription status. The sensitive content being inspected does not need to be uploaded to the DLP Shield service.
Encryption and data handling
How encryption applies to DLP Shield
Prompts and attachments inspected by DLP Shield are processed locally and are not transmitted to or stored by Compliance Tools. Communications required for account management, licensing, device enrolment and policy synchronisation are protected using HTTPS and TLS. Persisted service data is encrypted at rest under our hosting and database providers’ controls, and Mac enrolment credentials are stored using Apple Keychain. Payments are handled by Stripe, so Compliance Tools does not receive or store full payment card numbers.
Our production website, administration area and API require HTTPS, use HSTS and reject obsolete TLS 1.1 connections.
Service data stored by our hosting and database providers is protected using industry-standard AES-256 encryption at rest.
Once approved content is submitted, the selected AI provider’s encryption, retention and privacy controls apply.
Read our security statement. Further supplier assurance information is available to customers during due diligence.
Important distinction
Local scanning protects the step before sharing
If a user chooses to continue with approved content, that content is then sent to the selected AI platform as part of their normal use of that service. The AI provider’s own privacy, security and retention terms apply from that point. DLP Shield helps your business control what is allowed to reach that point.
Why businesses benefit
Content does not need to travel to a separate DLP service just to be inspected.
Checks happen before a prompt or attachment is submitted to ChatGPT or Claude.
The same centrally managed screening plan can be applied across Chrome on Windows PCs and Macs.
A practical privacy principle
Collect and transfer only what is needed. Local inspection supports that principle by keeping the sensitive material close to the user while still giving the organisation a consistent way to warn, block or redact before sharing.