Solution / AI DLP
Use AI while protecting sensitive content.
Patronus Protect inspects prompts and responses where AI runs, before encryption. Your policies redact, block or log each request without routing content through a scanning cloud.
Prompt before sending
Checked on the device- Name masked
- IBAN masked
- Margin withheld
The original values stay on the computer. The AI still answers.
01
Why classic DLP misses AI traffic
Prompts bypass file controls
Sensitive data is pasted into chats and IDE assistants instead of uploaded as a file. Attachment rules never see it.
TLS hides the content
Once an AI request reaches the network, its content is encrypted. Network controls can identify the connection, not the sensitive fields inside it.
Local models stay local
Requests to Ollama, LM Studio and on-device agents may never cross the network. Gateway-only DLP has no path to inspect them.
02
Inspect where the request starts
Intercept before encryption
Protect captures AI traffic on the computer, server or node before TLS, including requests to local models.
Classify locally
Local detection models identify personal data, credentials and confidential content without copying the prompt to a cloud scanner.
Enforce the policy
Based on data type and app, Protect redacts the affected values, blocks the request or records an audit event.
03
Control stays close to the data
On device
classification where the AI request originates
Before TLS
policy enforcement before content is encrypted
One layer
for browsers, desktop apps, APIs and local models
04
Questions about AI DLP
What is AI data loss prevention?
AI DLP inspects prompts, responses and agent traffic for personal data, credentials and confidential content. It applies policy before that content reaches a cloud model or local AI process.
How is this different from classic DLP?
Classic DLP focuses on files, email and uploads. AI DLP also understands conversational traffic, streamed responses and agent tool calls, including paths hidden inside encrypted connections.
Does prompt content leave the device for scanning?
No. Patronus classifies the content locally. The prompt is not copied to an external model or scanning cloud for the security decision.
Which AI paths are covered?
Patronus works across browser AI, desktop apps, IDE assistants, custom APIs and local models. Detection is provider-neutral, so policies do not depend on a separate integration for every tool.
Does redaction break the AI tool?
Redaction replaces only the sensitive values before the request continues. The AI receives a usable prompt while the protected data stays on the device.
Can AI agents leak data through tool calls?
Yes. File reads, API calls and MCP tool invocations can carry sensitive content. Patronus classifies these flows before execution and can redact or block them locally.